[Webkit-unassigned] [Bug 133531] New: REGRESSION prototype chain ignored accessing variables at global scope

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=133531

           Summary: REGRESSION prototype chain ignored accessing variables
                    at global scope
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
               URL: http://test.saurik.com/apple/protochain.html
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: saurik at saurik.com
                CC: oliver at apple.com, eoconnor at apple.com


To put this upfront: this issue affects JavaScriptCore on iOS 8.0 and Mac OS X 10.10. The functionality in question works on iOS 2-7 and OS X 10.5-9. I was told by an Apple engineer at WWDC to file a bug here and start the summary with "REGRESSION". I attempted to replicate this issue in a browser, and it seems my attempt "fails" on older versions (iOS 6/7, OS X 10.8/9), but I could see many (maybe silly/wrong) reasons why this might be different.

So, here's an example interaction (using a JavaScript REPL that runs everything through JavaScriptCore). I am going to assign the prototype of the global object and then walk to a variable. My REPL prints objects using JSObjectCopyPropertyNames, but I have also provided code using a for/in loop to get the same data into an array (note the REPL shows the array as an object). Note that I am using the global object: the scenario works for other objects.

I have filed two separate bugs because I was asked to do so by Oliver. This bug is regarding a ReferenceError that results attempting to walk prototypes at global scope.

Here is the working behavior from the old version of JavaScriptCore:

cy# a = {}; this.__proto__ = a; a.f = 5; this
{a:{f:5},f:5}
cy# this.f
5
cy# f
5

Here is the broken behavior from the new version of JavaScriptCore:

cy# a = {}; this.__proto__ = a; a.f = 5; this
{a:{f:5}}
cy# this.f
5
cy# f
ReferenceError: Can't find variable: f

FWIW, if there is some different way of doing this, if this was never supposed to have worked, etc. I would be more than happy to be told "do something different". I don't see myself why this shouldn't work, however, and I've been doing this without issue now on JavaScriptCore for over five years.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.