[Webkit-unassigned] [Bug 88401] New: Assigning to a static property should not change iteration order

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=88401

           Summary: Assigning to a static property should not change
                    iteration order
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: barraclough at apple.com


A specific iteration order is not defined by the spec, but test-262 somewhat tenuously requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
Whilst it is not clear that this behavior really arises from the specification, it would seem like common sense to conform to this.

The problem here is that we allow properties in the structure to shadow those in the static table, and we iterate the properties in the structure first - which means that as values of existing properties are modified, their iteration order changes too.

The easy fix is to iterate the properties from the static table first.  This has a further benefit, since it will mean that user added properties will come after those present in the static table (respected the expected insertion-order).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.