Bug 163579 - Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
Summary: Fix how JSFunction handles "caller" and "arguments" for functions that don't ...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
Keywords: InRadar
Depends on:
Reported: 2016-10-17 19:02 PDT by Caitlin Potter (:caitp)
Modified: 2017-12-13 09:42 PST (History)
14 users (show)

See Also:

patch (8.62 KB, patch)
2017-12-13 00:02 PST, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Caitlin Potter (:caitp) 2016-10-17 19:02:27 PDT
The following code in Source/JavaScriptCore/runtime/JSFunction.cpp, added in 2011, could use some investigation/auditing:

        // This will trigger the property to be reified, if this is not already the case!
         bool okay = thisObject->hasProperty(exec, propertyName);
         ASSERT_UNUSED(okay, okay);
         return Base::put(thisObject, exec, propertyName, value, slot);

It's unclear what the purpose of reifying this is, as the properties in question are not lazy. Base::put() ought to be enough.
Comment 1 Saam Barati 2017-12-12 23:12:32 PST
It turns out that not only is this not needed, this weird behavior is causing observable side effects.
Comment 2 Saam Barati 2017-12-12 23:35:12 PST
Comment 3 Saam Barati 2017-12-13 00:02:19 PST
Created attachment 329211 [details]
Comment 4 Saam Barati 2017-12-13 00:05:04 PST
There's a chance I need to update test262 test expectations.
Comment 5 Mark Lam 2017-12-13 00:46:52 PST
Comment on attachment 329211 [details]

Comment 6 WebKit Commit Bot 2017-12-13 09:29:25 PST
Comment on attachment 329211 [details]

Clearing flags on attachment: 329211

Committed r225845: <https://trac.webkit.org/changeset/225845>
Comment 7 WebKit Commit Bot 2017-12-13 09:29:26 PST
All reviewed patches have been landed.  Closing bug.
Comment 8 Caitlin Potter (:caitp) 2017-12-13 09:42:16 PST