[Webkit-unassigned] [Bug 222538] REGRESSION: Object.defineProperties triggering a setter

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=222538

--- Comment #7 from Yusuke Suzuki <ysuzuki at apple.com> ---
(In reply to Mark S. Miller from comment #0)
> Created attachment 421790 [details]
> Screenshot of debugger state caught in buggy behavior
> 
> See https://github.com/Agoric/SES-shim/pull/592
> 
> The SES Demo console, after previously having worked on Safari Technology
> Preview, suddenly started failing with an infinite recursion. This
> instrumented variation of the PR in which this started failing catches when
> `Object.defineProperties` causes a setter to be called. The
> `Object.defineProperties` is attempting to convert
> `Array.prototype.toString` from a data property to an accessor property,
> after `Object.prototype.toString` has been similarly converted. Violating
> the semantics of `defineProperties`, it causes the setter of the
> `Object.prototype.toString` accessor property to be called. There follows
> some screenshots examining this state from within the debugger.
> 
> This is on Safari Technology Preview
> Release 121 (Safari 14.2, WebKit 16612.1.4.3)

Thanks for the report! Is there a instruction reproducing this problem?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210301/e95e35dc/attachment.htm>