JSObjectHasProperty is stuck in an infinite loop with following code: static JSValueRef fn(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) { return 0; } static JSStaticFunction globalObject_staticFunctions[] = { { "fn", fn, kJSPropertyAttributeNone }, { 0, 0, 0 } }; static void freeze() { JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty; globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions; JSClassRef globalObjectClass = JSClassCreate( &globalObjectClassDefinition); JSGlobalContextRef context = JSGlobalContextCreateInGroup(NULL, globalObjectClass); JSStringRef propName = JSStringCreateWithUTF8CString("name"); JSObjectHasProperty( context, JSContextGetGlobalObject(context), propName); } Adding the attribute kJSClassAttributeNoAutomaticPrototype to the global class definition solves the problem. Note that JSObjectSetProperty is also stuck without the attribute because it internally calls the same code as JSObjectHasProperty. Also note that JSObjectHasProperty from MacOSX10.5 webkit framework doesn't get stuck.
<rdar://problem/6561016>
For some reason the global object's prototype gets itself as its prototype :-/
I'll take this bug.
This regressed with r36016, the first inline caching patch: http://trac.webkit.org/changeset/36016
Created attachment 28769 [details] Proposed patch Here's a fix. I'll add a test to testapi for this.
Comment on attachment 28769 [details] Proposed patch r=me
Landed in r41846 with a test added to testapi.