Bug 23771 - REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype
Summary: REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSC...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Cameron Zwarich (cpst)
Keywords: HasReduction, InRadar, Regression
Depends on:
Reported: 2009-02-05 14:08 PST by laurent calburtin
Modified: 2009-03-19 17:04 PDT (History)
2 users (show)

See Also:

Proposed patch (697 bytes, patch)
2009-03-19 16:26 PDT, Cameron Zwarich (cpst)
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description laurent calburtin 2009-02-05 14:08:01 PST
JSObjectHasProperty is stuck in an infinite loop with following code:

static JSValueRef fn(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
    return 0;

static JSStaticFunction globalObject_staticFunctions[] = {  { "fn", fn, kJSPropertyAttributeNone },  { 0, 0, 0 } };

static void freeze()
   JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
   globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions;
   JSClassRef globalObjectClass = JSClassCreate( &globalObjectClassDefinition);
   JSGlobalContextRef context = JSGlobalContextCreateInGroup(NULL, globalObjectClass);
   JSStringRef propName = JSStringCreateWithUTF8CString("name");
   JSObjectHasProperty( context, JSContextGetGlobalObject(context), propName);

Adding the attribute kJSClassAttributeNoAutomaticPrototype to the global class definition solves the problem.

Note that JSObjectSetProperty is also stuck without the attribute because it internally calls the same code as JSObjectHasProperty.
Also note that JSObjectHasProperty from MacOSX10.5 webkit framework doesn't get stuck.
Comment 1 Geoffrey Garen 2009-02-05 14:50:51 PST
Comment 2 Oliver Hunt 2009-02-09 23:16:19 PST
For some reason the global object's prototype gets itself as its prototype :-/
Comment 3 Cameron Zwarich (cpst) 2009-03-19 00:58:25 PDT
I'll take this bug.
Comment 4 Cameron Zwarich (cpst) 2009-03-19 04:09:35 PDT
This regressed with r36016, the first inline caching patch:

Comment 5 Cameron Zwarich (cpst) 2009-03-19 16:26:32 PDT
Created attachment 28769 [details]
Proposed patch

Here's a fix. I'll add a test to testapi for this.
Comment 6 Geoffrey Garen 2009-03-19 16:48:02 PDT
Comment on attachment 28769 [details]
Proposed patch

Comment 7 Cameron Zwarich (cpst) 2009-03-19 17:04:38 PDT
Landed in r41846 with a test added to testapi.