[Webkit-unassigned] [Bug 158295] New: JSGlobalObject::addFunction should call deleteProperty rather than removeDirect

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158295

            Bug ID: 158295
           Summary: JSGlobalObject::addFunction should call deleteProperty
                    rather than removeDirect
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: barraclough at apple.com

The fact we're calling removeDirect here means that there is dependency that JSGlobalObject symbol table properties mush have higher precedence than JSDOMWindow static properties. As a part of cleaning up & encapsulating static table lookup within JSObject (bug #158178) this order is going to change; reacting to be able to support this.

When program code is executed, and that program code declares functions, upon entry symbol table entries on the global object are created for those functions. Any conflicting existing properties are removed from the global object's property storage. There should not ever be duplicate entries in property storage and the symbol table. However because we currently use removeDirect to remove conflicts, this fails to delete any copies of the property in the static table (deleteProperty would).

Precedence of property lookup for global objects is currently something like:

1) JSObject property storage array
2) JSObject static property map
3) JSGlobalObject static property map
4) Symbol table
5) JSDOMWindow static property map

We get away with failing to remove entries from static tables because (a) currently neither JSObject nor JSGlobalObject actually have any static table properties, and (b) since symbol table lookup currently takes precedence over the JSDOMWindow static table we get away with leaving a stale value in it.

As a part of bug #158178 access order will be more like:

1) JSObject property storage array
2) JSDOMWindow static property map
3) JSGlobalObject static property map
4) JSObject static property map
5) Symbol table

(Static table properties performed at a consistent time, and with most derived type having greatest precedence such that it can override values.) Post bug #158178, this issue will have testing coverage from existing tests (e.g. fast/encoding/parser-tests-50.html replaces alert).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160602/41da1c7a/attachment.html>