Bug 91270 – a = data[a]++; sets the wrong key in data

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Malte Ubl]

Hey,

this code has different behavior in JSC from all other engines.

var data = {'test': 0};
var a = 'test';
a = data[a]++;

Data now contains {"test":0,"0":1} instead of  {"test":1}

[Alexey Proskuryakov]

Where are you seeing this issue? I cannot reproduce in Web Inspector using Safari 5.1.7 or nightly r122160.

[Malte Ubl]

Ha, apparently jsfiddle adds stuff that is necessary to repro.

This repros for me in the console
var data = {'test': 0};
(function() {
var a = 'test';
a = data[a]++;
})();
data

in both Safari 5.x and 6.x. I don't have a webkit nightly handy.

[Alexey Proskuryakov]

Thank you, I can reproduce now. CC'ing some JSC engineers.

[Geoffrey Garen]

<rdar://problem/11882895>

[Gavin Barraclough]

Created attachment 162391 [details]
Fix

[Gavin Barraclough]

Fixed in r127676