Bug 236330 – [JSC] OrdinarySet should invoke custom [[Set]] methods for indexed puts

• Component: New Bugs
• Status: NEW

[Alexey Shvayka]

[JSC] OrdinarySet should invoke custom [[Set]] methods for indexed puts

[Alexey Shvayka]

Created attachment 451306 [details]
Patch

[Alexey Shvayka]

Created attachment 451388 [details]
Patch

Adjust tests.

[Saam Barati]

Comment on attachment 451388 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=451388&action=review

> Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:405
> +        if (UNLIKELY(slot.thisValue() != thisObject)) {

can we do the "isThisValueAltered" thing?

> Source/JavaScriptCore/runtime/JSObject.cpp:2899
> +        if (current->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {

this is bizarre that we're using this flag to indicate what to do for put. This feels like an inconsistent fix to me.

> Source/JavaScriptCore/runtime/StructureInlines.h:93
> +    if (typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
> +        return true;

this is not the intention of this flag. Now, if you put a typed array in a prototype chain, you're going to "have a bad time". Why is this needed?

[Radar WebKit Bug Importer]

<rdar://problem/88988175>