<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Inconsistent behaviour of enumerable flag of length property in arguments object"
href="https://bugs.webkit.org/show_bug.cgi?id=146510">146510</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Inconsistent behaviour of enumerable flag of length property in arguments object
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Minor
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>erik@webbies.dk
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=255917" name="attach_255917" title="Demonstration of the problem">attachment 255917</a> <a href="attachment.cgi?id=255917&action=edit" title="Demonstration of the problem">[details]</a></span>
Demonstration of the problem
There are two ways of accessing the arguments object in JavaScriptCore, with the arguments variable, and with Function.argument. Below is a function that accesses both these values:
function example() {
print(arguments);
print(example.arguments);
}
The two objects both contains the arguments given to the function, but they disagree on the value of the enumerable flag on the length attribute. In "arguments" it is false, whereas in "example.arguments" it is true.
This has the effect, among other things, that printing out the arguments with JSON.stringify will incorrectly include the length attribute when printing out the arguments object.
According to the ECMAScript Language Specification, the correct behavior is that the enumerable flag is set to false. (Both SpiderMonkey and V8 agree with this).
This was tested on a recently checked out version of WebKit, compiled on Ubuntu 15.04.
A testcase has been attached that demonstrates the issue.
--- Expected value ---
{
"length1": false,
"length2": false,
"funcArgs": {
"0": "P",
"1": "A",
"2": "S",
"3": "S"
},
"args": {
"0": "P",
"1": "A",
"2": "S",
"3": "S"
}
}
--- Actual value ---
{
"length1": true,
"length2": false,
"funcArgs": {
"0": "P",
"1": "A",
"2": "S",
"3": "S",
"length": 4
},
"args": {
"0": "P",
"1": "A",
"2": "S",
"3": "S"
}
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>