Bug 230150 – [JSC][32bit] in-by-val fails inside for-in loop after delete

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Xan Lopez]

Test:

function test2() {
    let o = {
        a:20,
        b:30,
        c:40,
        d:50
    };

    for (let p in o) {
        delete o[p];
        if (p in o)
            print("wtf");
    }
}
for (let i = 0; i < 1000; i++)
    test2();

Execution:

xlopez@bbox-11-armhf:~/WebKit$ ./WebKitBuild/Debug/bin/jsc -f ../js/in-by-test.js 
Exception: TypeError: o is not an Object. (evaluating 'p in o')
test2@../js/in-by-test.js:11:18
global code@../js/in-by-test.js:16:10

I believe this is fallout from https://commits.webkit.org/r280760, can be reproduced easily in ToT after the WIP patch in bug #229543 is applied.

[Xan Lopez]

Created attachment 438025 [details]
v1

This was a very silly mistake in the end.

[EWS]

Committed r282336 (241603@main): <https://commits.webkit.org/241603@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 438025 [details].

[Radar WebKit Bug Importer]

<rdar://problem/83062246>