Bug in numeric accessors on global environment

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Gavin Barraclough]

I've hit this assert in test262 in browser, but haven't yet worked out how to repro in a test case :-/
The sparsemap is failing to map back from the global object to the window shell.
A test case would need to resolve a numeric property name against the global environment.

[Gavin Barraclough]

Created attachment 165526 [details]
Fix

[Geoffrey Garen]

To do an assignment directly to the global object, you need to do it lexically, and not using "this" or "window". Perhaps calling bare __defineSetter__() and __defineGetter__() with a numeric property will do it.

[Geoffrey Garen]

Comment on attachment 165526 [details]
Fix

r=me

[Gavin Barraclough]

(In reply to comment #2)
> To do an assignment directly to the global object, you need to do it lexically, and not using "this" or "window". Perhaps calling bare __defineSetter__() and __defineGetter__() with a numeric property will do it.

Sadly __defineSetter__/__defineGetter__ will replace the current getter/setter, rather than calling it. :-/

I need something equivalent to
    window[0] = foo;
i.e. something that will do a [[Put]] rather than a [[DefineOwnProperty]], but where the base is the global environment.  Still haven't worked out how to do this for a numeric name.

[Gavin Barraclough]

Fixed in r129458