Bug 91270 - a = data[a]++; sets the wrong key in data
Summary: a = data[a]++; sets the wrong key in data
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Gavin Barraclough
Keywords: InRadar
Depends on:
Reported: 2012-07-13 12:51 PDT by Malte Ubl
Modified: 2012-09-05 19:02 PDT (History)
6 users (show)

See Also:

Fix (9.29 KB, patch)
2012-09-05 18:48 PDT, Gavin Barraclough
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Malte Ubl 2012-07-13 12:51:55 PDT

this code has different behavior in JSC from all other engines.

var data = {'test': 0};
var a = 'test';
a = data[a]++;

Data now contains {"test":0,"0":1} instead of  {"test":1}
Comment 1 Alexey Proskuryakov 2012-07-14 00:45:19 PDT
Where are you seeing this issue? I cannot reproduce in Web Inspector using Safari 5.1.7 or nightly r122160.
Comment 2 Malte Ubl 2012-07-14 09:59:11 PDT
Ha, apparently jsfiddle adds stuff that is necessary to repro.

This repros for me in the console
var data = {'test': 0};
(function() {
var a = 'test';
a = data[a]++;

in both Safari 5.x and 6.x. I don't have a webkit nightly handy.
Comment 3 Alexey Proskuryakov 2012-07-14 10:56:52 PDT
Thank you, I can reproduce now. CC'ing some JSC engineers.
Comment 4 Geoffrey Garen 2012-07-16 12:30:29 PDT
Comment 5 Gavin Barraclough 2012-09-05 18:48:31 PDT
Created attachment 162391 [details]
Comment 6 Gavin Barraclough 2012-09-05 19:02:33 PDT
Fixed in r127676