Bug 15927 - REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property
Summary: REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorre...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Darin Adler
Keywords: HasReduction, Regression
Depends on:
Reported: 2007-11-09 15:32 PST by Khoo Yit Phang
Modified: 2007-11-10 17:10 PST (History)
2 users (show)

See Also:

Test case (1.18 KB, application/xhtml+xml)
2007-11-09 15:34 PST, Khoo Yit Phang
no flags Details
Working test case (1.10 KB, text/html)
2007-11-10 03:55 PST, Mark Rowe (bdash)
no flags Details
Test case in a testkjs-friendly form (370 bytes, text/plain)
2007-11-10 04:43 PST, Mark Rowe (bdash)
no flags Details
patch (4.82 KB, patch)
2007-11-10 12:14 PST, Darin Adler
sam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Khoo Yit Phang 2007-11-09 15:32:51 PST
When a property is deleted, and a getter/setter of the same name is create, another unrelated property will be deleted as well:

    var obj = { a:1, b:2, c:3, d:4, e:5 }
    delete obj.c;
    obj.__defineGetter__("c", function() { return 3 });
    /* obj.e will be deleted!*/

My testing seems to indicate that the latest-defined property is the one that gets deleted; mistakenly replaced by the getter/setter perhaps?
Comment 1 Khoo Yit Phang 2007-11-09 15:34:21 PST
Created attachment 17163 [details]
Test case
Comment 2 Mark Rowe (bdash) 2007-11-10 03:55:28 PST
Created attachment 17169 [details]
Working test case

The test case provided throws a JavaScript exception.  I've attached a fixed version that demonstrates the issue.
Comment 3 Mark Rowe (bdash) 2007-11-10 03:56:11 PST
This is a regression from WebKit in Leopard.
Comment 4 Mark Rowe (bdash) 2007-11-10 04:42:20 PST
"git bisect" narrowed this down to regressing in r27487 (http://trac.webkit.org/projects/webkit/changeset/27487).  Running with hashtable consistency checks on does not turn up anything useful.

CC'ing Darin as he was responsible for the change that introduced this regression.
Comment 5 Mark Rowe (bdash) 2007-11-10 04:43:40 PST
Created attachment 17171 [details]
Test case in a testkjs-friendly form

This is the same test case in a testkjs-friendly form.  It also prints out a handy SUCCESS or FAIL at the end.
Comment 6 Darin Adler 2007-11-10 12:14:20 PST
Created attachment 17173 [details]
Comment 7 Sam Weinig 2007-11-10 16:11:10 PST
Comment on attachment 17173 [details]

r=me.  Are we considering 4k large these days?
Comment 8 Darin Adler 2007-11-10 17:10:44 PST
Committed revision 27678.