[Webkit-unassigned] [Bug 146510] New: Inconsistent behaviour of enumerable flag of length property in arguments object

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=146510

            Bug ID: 146510
           Summary: Inconsistent behaviour of enumerable flag of length
                    property in arguments object
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: PC
                OS: Unspecified
            Status: NEW
          Severity: Minor
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: erik at webbies.dk

Created attachment 255917
  --> https://bugs.webkit.org/attachment.cgi?id=255917&action=review
Demonstration of the problem

There are two ways of accessing the arguments object in JavaScriptCore, with the arguments variable, and with Function.argument. Below is a function that accesses both these values: 

function example() {
   print(arguments);
   print(example.arguments);
}

The two objects both contains the arguments given to the function, but they disagree on the value of the enumerable flag on the length attribute. In "arguments" it is false, whereas in "example.arguments" it is true. 
This has the effect, among other things, that printing out the arguments with JSON.stringify will incorrectly include the length attribute when printing out the arguments object. 

According to the ECMAScript Language Specification, the correct behavior is that the enumerable flag is set to false. (Both SpiderMonkey and V8 agree with this). 

This was tested on a recently checked out version of WebKit, compiled on Ubuntu 15.04. 

A testcase has been attached that demonstrates the issue.

--- Expected value ---
{
 "length1": false,
 "length2": false,
 "funcArgs": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 },
 "args": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 }
}


--- Actual value ---
{
 "length1": true,
 "length2": false,
 "funcArgs": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S",
  "length": 4
 },
 "args": {
  "0": "P",
  "1": "A",
  "2": "S",
  "3": "S"
 }
}

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150701/81df62b0/attachment-0001.html>