Bug 177772 - many properties appearing on object when assigning numeric keys and values
Summary: many properties appearing on object when assigning numeric keys and values
Status: RESOLVED CONFIGURATION CHANGED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 10
Hardware: Mac Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-02 13:25 PDT by craft
Modified: 2017-10-08 17:39 PDT (History)
5 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description craft 2017-10-02 13:25:04 PDT
Sometimes when assigning numeric values to numeric keys, an object abruptly acquires hundreds of keys with value NaN.

I'm unable to reproduce this outside of a large application, however here is a cut & paste from the debugger. The
breakpoint is in underscore's _.object() method, on the condition that Object.keys(result) is larger than list.length.

> var result2 = {}
< undefined
> for (var k = 0; k < 6; ++k) { result2[list[k]] = values[k]; }
< 5
> JSON.stringify(result2)
< "{\"134\":1,\"180\":3,\"202\":2,\"213\":4,\"332\":5,\"832\":0}"
> result2[list[6]]=values[6]
< 6
> JSON.stringify(result2).slice(0, 100)
< "{\"0\":null,\"1\":null,\"2\":null,\"3\":null,\"4\":null,\"5\":null,\"6\":null,\"7\":null,\"8\":null,\"9\":null,\"10\":null"
> JSON.stringify(list.slice(0, 7))
< "[832,134,202,180,213,332,1154]"
> JSON.stringify(values.slice(0, 7))
< "[0,1,2,3,4,5,6]"
> result2[0]
< NaN

It looks very much like an optimization that changes the backing store to a dense array of integers (hence the NaN values), that is leaking into the exposed properties of the object. Similar to the earlier 'phantom length' problem, perhaps.
Comment 1 Alexey Proskuryakov 2017-10-03 19:58:22 PDT
Thank you for the report! Can you reproduce this with Safari 11?
Comment 2 Mark Lam 2017-10-03 20:01:22 PDT
This looks very much like an old bug we've fixed.  I'll look for the other bug that has this fix.  Please check if this reproduces on the latest Safari i.e. Safari 11.  Thanks.
Comment 3 Mark Lam 2017-10-03 20:56:16 PDT
(In reply to Mark Lam from comment #2)
> This looks very much like an old bug we've fixed.

I suspect that this is a dupe of https://bugs.webkit.org/show_bug.cgi?id=164412.
Comment 4 craft 2017-10-06 13:50:27 PDT
We are not able to reproduce it on safari 11.
Comment 5 Saam Barati 2017-10-08 17:39:54 PDT
(In reply to craft from comment #4)
> We are not able to reproduce it on safari 11.

👍🏽