Bug 44240 – REGRESSION (r62896): Interpreter incorrectly excludes prototype chain when validating put_by_id_transition

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[David Kilzer (:ddkilzer)]

LayoutTests/fast/js/dictionary-no-cache.html fails using the JSC interpreter, but passes using the JSC JIT.

--- a/LayoutTests/fast/js/dictionary-no-cache-expected.txt
+++ b/LayoutTests/fast/js/dictionary-no-cache-expected.txt
@@ -5,7 +5,7 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 PASS foundNewPrototypeProperty is true
 PASS foundRemovedPrototypeProperty is false
-PASS calledNewPrototypeSetter is true
+FAIL calledNewPrototypeSetter should be true. Was false.
 PASS getTestProperty(test4) is "on prototype"
 PASS getTestProperty(test4) is "on self"
 PASS getTestProperty(test5) is "on prototype's prototype"

[David Kilzer (:ddkilzer)]

<rdar://problem/8328995>

[Oliver Hunt]

*** Bug 44241 has been marked as a duplicate of this bug. ***

[Oliver Hunt]

Created attachment 65184 [details]
Patch

[Darin Adler]

Comment on attachment 65184 [details]
Patch

Is there a regression test covering this already?

[Oliver Hunt]

Committed r65847

[David Kilzer (:ddkilzer)]

(In reply to comment #4)
> (From update of attachment 65184 [details])
> Is there a regression test covering this already?

Yes, except we don't have any buildbots running tests with the JSC Interpreter:

fast/js/dictionary-no-cache.html
fast/js/pic/cached-prototype-setter.html

[David Kilzer (:ddkilzer)]

The regression was introduced in r62896 for Bug 41929.
<http://trac.webkit.org/changeset/62896>