Bug 44240

Summary: REGRESSION (r62896): Interpreter incorrectly excludes prototype chain when validating put_by_id_transition
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer@webkit.org>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned@lists.webkit.org>
Status: RESOLVED FIXED    
Severity: Normal CC: darin@apple.com, ggaren@apple.com, oliver@apple.com
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Macintosh   
OS: Mac OS X 10.6   
Bug Depends on: 41929    
Bug Blocks:    
Attachments:
Description Flags
Patch darin: review+

Description From 2010-08-19 04:41:25 PST
LayoutTests/fast/js/dictionary-no-cache.html fails using the JSC interpreter, but passes using the JSC JIT.

--- a/LayoutTests/fast/js/dictionary-no-cache-expected.txt
+++ b/LayoutTests/fast/js/dictionary-no-cache-expected.txt
@@ -5,7 +5,7 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE

 PASS foundNewPrototypeProperty is true
 PASS foundRemovedPrototypeProperty is false
-PASS calledNewPrototypeSetter is true
+FAIL calledNewPrototypeSetter should be true. Was false.
 PASS getTestProperty(test4) is "on prototype"
 PASS getTestProperty(test4) is "on self"
 PASS getTestProperty(test5) is "on prototype's prototype"
------- Comment #1 From 2010-08-19 04:48:05 PST -------
<rdar://problem/8328995>
------- Comment #2 From 2010-08-23 16:32:10 PST -------
*** Bug 44241 has been marked as a duplicate of this bug. ***
------- Comment #3 From 2010-08-23 16:51:37 PST -------
Created an attachment (id=65184) [details]
Patch
------- Comment #4 From 2010-08-23 16:54:25 PST -------
(From update of attachment 65184 [details])
Is there a regression test covering this already?
------- Comment #5 From 2010-08-23 17:05:39 PST -------
Committed r65847
------- Comment #6 From 2010-08-23 17:40:37 PST -------
(In reply to comment #4)
> (From update of attachment 65184 [details] [details])
> Is there a regression test covering this already?

Yes, except we don't have any buildbots running tests with the JSC Interpreter:

fast/js/dictionary-no-cache.html
fast/js/pic/cached-prototype-setter.html
------- Comment #7 From 2010-08-24 10:08:04 PST -------
The regression was introduced in r62896 for Bug 41929.
<http://trac.webkit.org/changeset/62896>