Bug 88401 - Assigning to a static property should not change iteration order
Summary: Assigning to a static property should not change iteration order
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-06-06 01:50 PDT by Gavin Barraclough
Modified: 2012-06-06 17:34 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2012-06-06 01:50:16 PDT
A specific iteration order is not defined by the spec, but test-262 somewhat tenuously requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
Whilst it is not clear that this behavior really arises from the specification, it would seem like common sense to conform to this.

The problem here is that we allow properties in the structure to shadow those in the static table, and we iterate the properties in the structure first - which means that as values of existing properties are modified, their iteration order changes too.

The easy fix is to iterate the properties from the static table first.  This has a further benefit, since it will mean that user added properties will come after those present in the static table (respected the expected insertion-order).
Comment 1 Gavin Barraclough 2012-06-06 15:10:02 PDT
Fixed in r119623
Comment 2 Geoffrey Garen 2012-06-06 17:34:16 PDT
<http://trac.webkit.org/changeset/119623>