Here's the bug. Suppose you call JSObject::getOwnProperty and: * PropertyName contains an index * An object on the prototype chain overrides getOwnPropertySlot, and has that index property * The base of the access (or another object on the prototype chain) shadows that property JSObject::getPropertySlot is written assuming the common case is that propertyName is not an index, and as such walks up the prototype chain looking for non-index properties before it tries calling parseIndex. At the point we reach an object on the prototype chain overriding getOwnPropertySlot (which would potentially return the property) we may have already skipped over non-overriding objects that contain the property in index storage.
Created attachment 271696 [details] Fix
Created attachment 271697 [details] Fix
Attachment 271697 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/ChangeLog:9: Need whitespace between colon and description [changelog/filechangedescriptionwhitespace] [5] ERROR: Source/JavaScriptCore/ChangeLog:10: Need whitespace between colon and description [changelog/filechangedescriptionwhitespace] [5] ERROR: Source/JavaScriptCore/ChangeLog:11: Need whitespace between colon and description [changelog/filechangedescriptionwhitespace] [5] ERROR: Source/JavaScriptCore/runtime/JSObject.h:861: The parameter name "propertyName" adds no information, so it should be removed. [readability/parameter_name] [5] Total errors found: 4 in 8 files If any of these errors are false positives, please file a bug against check-webkit-style.
Comment on attachment 271697 [details] Fix Attachment 271697 [details] did not pass mac-ews (mac): Output: http://webkit-queues.webkit.org/results/851606 New failing tests: streams/reference-implementation/abstract-ops.html
Created attachment 271704 [details] Archive of layout-test-results from ews101 for mac-yosemite The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews101 Port: mac-yosemite Platform: Mac OS X 10.10.5
Comment on attachment 271697 [details] Fix Attachment 271697 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/851608 New failing tests: streams/reference-implementation/abstract-ops.html
Created attachment 271706 [details] Archive of layout-test-results from ews105 for mac-yosemite-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews105 Port: mac-yosemite-wk2 Platform: Mac OS X 10.10.5
Comment on attachment 271697 [details] Fix Attachment 271697 [details] did not pass mac-debug-ews (mac): Output: http://webkit-queues.webkit.org/results/851626 New failing tests: streams/reference-implementation/abstract-ops.html
Created attachment 271708 [details] Archive of layout-test-results from ews113 for mac-yosemite The attached test failures were seen while running run-webkit-tests on the mac-debug-ews. Bot: ews113 Port: mac-yosemite Platform: Mac OS X 10.10.5
Created attachment 271766 [details] Fix
Comment on attachment 271766 [details] Fix Attachment 271766 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/855539 Number of test failures exceeded the failure limit.
Created attachment 271774 [details] Archive of layout-test-results from ews107 for mac-yosemite-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews107 Port: mac-yosemite-wk2 Platform: Mac OS X 10.10.5
Comment on attachment 271766 [details] Fix Attachment 271766 [details] did not pass mac-ews (mac): Output: http://webkit-queues.webkit.org/results/855552 Number of test failures exceeded the failure limit.
Created attachment 271775 [details] Archive of layout-test-results from ews103 for mac-yosemite The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews103 Port: mac-yosemite Platform: Mac OS X 10.10.5
Comment on attachment 271766 [details] Fix Attachment 271766 [details] did not pass mac-debug-ews (mac): Output: http://webkit-queues.webkit.org/results/855569 Number of test failures exceeded the failure limit.
Created attachment 271777 [details] Archive of layout-test-results from ews116 for mac-yosemite The attached test failures were seen while running run-webkit-tests on the mac-debug-ews. Bot: ews116 Port: mac-yosemite Platform: Mac OS X 10.10.5
Created attachment 271819 [details] Fix
Comment on attachment 271819 [details] Fix r=me
Committed revision 196849.