RESOLVED FIXED 25560
REGRESSION (r34821): "string value".__proto__ gets the wrong object. 
https://bugs.webkit.org/show_bug.cgi?id=25560
Summary REGRESSION (r34821): "string value".__proto__ gets the wrong object.
Erik Corry
Reported Tuesday, May 5, 2009 9:51:22 AM UTC
This is a regression. The problem is not present in eg. Safari 3.2.2 for Windows. In the latest WebKit nightlies and in the Safari 4 beta for OSX it is present. Here is a snippet to reproduce it: <script> "foo".__proto__.foo = "bar"; if (Object.prototype.foo == "bar") alert("Has Safari __proto__ bug"); else alert("Doesn't have Safari __proto__ bug"); </script> It seems the problem is restricted to string values. new String("foo").__proto__ gets the right object.
Attachments
patch -- needs regression test before review (773 bytes, patch)
2009-05-07 18:40 PDT, Darin Adler 		no flags
DetailsFormatted DiffDiff
patch (6.35 KB, patch)
2009-05-11 11:31 PDT, Darin Adler 		oliver: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 Wednesday, May 6, 2009 12:34:23 PM UTC
<rdar://problem/6861069>
Darin Adler
Comment 2 Friday, May 8, 2009 2:40:39 AM UTC
Created attachment 30127 [details] patch -- needs regression test before review
Darin Adler
Comment 3 Monday, May 11, 2009 7:31:47 PM UTC
Created attachment 30195 [details] patch
Darin Adler
Comment 4 Monday, May 11, 2009 7:55:33 PM UTC
http://trac.webkit.org/changeset/43506
Note You need to log in before you can comment on or make changes to this bug.