[Webkit-unassigned] [Bug 159398] [test262] Fixing mapped arguments object property test case

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159398

--- Comment #43 from Caio Lima <ticaiolima at gmail.com> ---
Comment on attachment 284985
  --> https://bugs.webkit.org/attachment.cgi?id=284985
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=284985&action=review

>> Source/JavaScriptCore/ChangeLog:11
>> +        cannot be deleted when argument "i" is not configurable.
> 
> Shouldn't being non-configurable mean you can't be deleted?

Yes. The current behavior is not following this rule.

>> Source/JavaScriptCore/ChangeLog:14
>> +        aliased xor stored in a JSObject with attributes. This patch changes
> 
> what does it mean to be aliased in this situation?

Aliased I mean that for example:
```
((a) => {
  print(a); // prints 2
  print(arguments[0]); prints 2
  a = 3;
  print(a); // prints 3
  print(arguments[0]); // prints 3 because it is aliased with a 
})(2);

>> Source/JavaScriptCore/ChangeLog:18
>> +        attribute is true. It is important realize that when the attribute is
> 
> Really? I thought it can't be deleted if configurable is false. That's how normal objects work, anyways.

I think I was not very clear in this ChangeLog. What I am trying to say is that when {configurable: false}, the member can't be deleted. In the current behavior it is not true and when arguments object isn't aliases with parameters, delete operations succeed, which is against specification.

>> Source/JavaScriptCore/runtime/GenericArgumentsInlines.h:145
>> +    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
> 
> Seems like this should be ::VMInquiry. ::GetOwnProperty is allowed to do arbitrary side effects.

I am going to change it now. Also, as Darin Adler commented above, it is also not optimized.

>> Source/JavaScriptCore/runtime/GenericArgumentsInlines.h:238
>> +            if ((descriptor.writablePresent() && !descriptor.writable()) || descriptor.isAccessorDescriptor())
> 
> Why do we care about it being non-writable? I thought for deleting a property, we care about it being configurable?

This logic here is not related with {configurable}. In this current Patch, the configurable case is checked on lines 192 - 180. Here we are controlling the aliasing of "arguments" object. Checking the specification (http://www.ecma-international.org/ecma-262/7.0/index.html#sec-createunmappedargumentsobject), all indexed elements from arguments are "writable: true", which means that they are aliased by default. To stop the aliasing, "descriptor.writable" need to be present and false.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160926/d20ec668/attachment.html>