Bug 23771 – REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[laurent calburtin]

JSObjectHasProperty is stuck in an infinite loop with following code:

static JSValueRef fn(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
{
    return 0;
}

static JSStaticFunction globalObject_staticFunctions[] = {  { "fn", fn, kJSPropertyAttributeNone },  { 0, 0, 0 } };

static void freeze()
{
   JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
   globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions;
   JSClassRef globalObjectClass = JSClassCreate( &globalObjectClassDefinition);
   JSGlobalContextRef context = JSGlobalContextCreateInGroup(NULL, globalObjectClass);
   JSStringRef propName = JSStringCreateWithUTF8CString("name");
   JSObjectHasProperty( context, JSContextGetGlobalObject(context), propName);
}

Adding the attribute kJSClassAttributeNoAutomaticPrototype to the global class definition solves the problem.

Note that JSObjectSetProperty is also stuck without the attribute because it internally calls the same code as JSObjectHasProperty.
Also note that JSObjectHasProperty from MacOSX10.5 webkit framework doesn't get stuck.

[Geoffrey Garen]

<rdar://problem/6561016>

[Oliver Hunt]

For some reason the global object's prototype gets itself as its prototype :-/

[Cameron Zwarich (cpst)]

I'll take this bug.

[Cameron Zwarich (cpst)]

This regressed with r36016, the first inline caching patch:

http://trac.webkit.org/changeset/36016

[Cameron Zwarich (cpst)]

Created attachment 28769 [details]
Proposed patch

Here's a fix. I'll add a test to testapi for this.

[Geoffrey Garen]

Comment on attachment 28769 [details]
Proposed patch

r=me

[Cameron Zwarich (cpst)]

Landed in r41846 with a test added to testapi.