Bug 25560 - REGRESSION (r34821): "string value".__proto__ gets the wrong object.
Summary: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Darin Adler
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2009-05-05 01:51 PDT by Erik Corry
Modified: 2009-05-11 11:55 PDT (History)
0 users

See Also:


Attachments
patch -- needs regression test before review (773 bytes, patch)
2009-05-07 18:40 PDT, Darin Adler
no flags Details | Formatted Diff | Diff
patch (6.35 KB, patch)
2009-05-11 11:31 PDT, Darin Adler
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Erik Corry 2009-05-05 01:51:22 PDT
This is a regression.  The problem is not present in eg. Safari 3.2.2 for Windows.  In the latest WebKit nightlies and in the Safari 4 beta for OSX it is present.  Here is a snippet to reproduce it:

<script>
"foo".__proto__.foo = "bar";
if (Object.prototype.foo == "bar") alert("Has Safari __proto__ bug");
else alert("Doesn't have Safari __proto__ bug");
</script>

It seems the problem is restricted to string values.  new String("foo").__proto__ gets the right object.
Comment 1 Alexey Proskuryakov 2009-05-06 04:34:23 PDT
<rdar://problem/6861069>
Comment 2 Darin Adler 2009-05-07 18:40:39 PDT
Created attachment 30127 [details]
patch -- needs regression test before review
Comment 3 Darin Adler 2009-05-11 11:31:47 PDT
Created attachment 30195 [details]
patch
Comment 4 Darin Adler 2009-05-11 11:55:33 PDT
http://trac.webkit.org/changeset/43506