Bug 26593 – Enumeration of prototypes with more than 64 properties cache not invalidated

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Sebastian Markbåge]

If object B inherits from prototype A and prototype A has more than 64 properties, it seems that the enumeration of properties of object B is cached.

However, if more properties are added to the prototype the cache is not invalidated.

So if an additional property is added to the prototype between enumerations, the new property is not enumerated over.

The linked example clearly illustrates this issue.

[Sebastian Markbåge]

Created attachment 31625 [details]
Test case

[Sam Weinig]

<rdar://problem/6992822>

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/interpreter/Interpreter.cpp
	M	JavaScriptCore/jit/JITStubs.cpp
	M	JavaScriptCore/runtime/Structure.cpp
	M	JavaScriptCore/runtime/StructureChain.cpp
	M	JavaScriptCore/runtime/StructureChain.h
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/js/dictionary-no-cache.html
	A	LayoutTests/fast/js/resources/dictionary-no-cache.js
Committed r45039

Please verify in the next nightly :D

[John-David Dalton]

In the attachment I noticed that performing something like

test2._x = 1; delete test2._x;

before the for-in loop seems to fix the issue.

[Jan Kassens]

Sebastian's test case works now here (nighly).