Bug 25560

Summary: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
Product: WebKit Reporter: Erik Corry <erikcorry>
Component: JavaScriptCoreAssignee: Darin Adler <darin>
Status: RESOLVED FIXED    
Severity: Normal Keywords: InRadar
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
patch -- needs regression test before review
none
patch oliver: review+

Erik Corry
Reported 2009-05-05 01:51:22 PDT
This is a regression. The problem is not present in eg. Safari 3.2.2 for Windows. In the latest WebKit nightlies and in the Safari 4 beta for OSX it is present. Here is a snippet to reproduce it: <script> "foo".__proto__.foo = "bar"; if (Object.prototype.foo == "bar") alert("Has Safari __proto__ bug"); else alert("Doesn't have Safari __proto__ bug"); </script> It seems the problem is restricted to string values. new String("foo").__proto__ gets the right object.
Attachments
patch -- needs regression test before review (773 bytes, patch)
2009-05-07 18:40 PDT, Darin Adler 		no flags
DetailsFormatted DiffDiff
patch (6.35 KB, patch)
2009-05-11 11:31 PDT, Darin Adler 		oliver: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2009-05-06 04:34:23 PDT
<rdar://problem/6861069>
Darin Adler
Comment 2 2009-05-07 18:40:39 PDT
Created attachment 30127 [details] patch -- needs regression test before review
Darin Adler
Comment 3 2009-05-11 11:31:47 PDT
Created attachment 30195 [details] patch
Darin Adler
Comment 4 2009-05-11 11:55:33 PDT
http://trac.webkit.org/changeset/43506
Note You need to log in before you can comment on or make changes to this bug.