[Webkit-unassigned] [Bug 154416] New: JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=154416

            Bug ID: 154416
           Summary: JSObject::getPropertySlot - index-as-propertyname,
                    override on prototype, & shadow
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: barraclough at apple.com

Here's the bug. Suppose you call JSObject::getOwnProperty and:
 * PropertyName contains an index
 * An object on the prototype chain overrides getOwnPropertySlot, and has that index property
 * The base of the access (or another object on the prototype chain) shadows that property

JSObject::getPropertySlot is written assuming the common case is that propertyName is not an
index, and as such walks up the prototype chain looking for non-index properties before it
tries calling parseIndex.

At the point we reach an object on the prototype chain overriding getOwnPropertySlot (which
would potentially return the property) we may have already skipped over non-overriding
objects that contain the property in index storage.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160218/cb6cd4ea/attachment-0001.html>