<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [JSC] indexed property doesn't work well"
href="https://bugs.webkit.org/show_bug.cgi?id=145358#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [JSC] indexed property doesn't work well"
href="https://bugs.webkit.org/show_bug.cgi?id=145358">bug 145358</a>
from <span class="vcard"><a class="email" href="mailto:utatane.tea@gmail.com" title="Yusuke Suzuki <utatane.tea@gmail.com>"> <span class="fn">Yusuke Suzuki</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=145358#c2">comment #2</a>)
<span class="quote">> The following code will fail with assertions.
>
> (function () {
> Object.defineProperty(Object.prototype, 0, {
> get() {
> print("Get");
> },
> set() {
> print("Set");
> }
> });
> var object = {
> length: 5,
> 0: 0,
> get 1() {
> return 1;
> },
> set 1(value) {
> throw new Error(2);
> },
> 2: 2,
> 3: 3,
> };
> }());</span >
The remaining issue is this.
1. JSObject has 2 storage, vector and map. And map has 2 types, non-sparse and sparse (dictionary mode)
2. If the JSObject is the dictionary mode, there's no vector
3. If the map of the JSObject is non-sparse, there may be the vector. But the ranges of these storages are not overlapped.
4. And JSObject stores the accessor into the map that is not marked as the sparse.
5. But in the other place (like JSArray), they assume that the map does not contain the accessors if the map is not marked as the sparse.
The simplest solution is, "when storing the indexed accessor, always make the object the dictionary mode". But one concern is the performance regression.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>