205661 - Unexpected prototype and Java setter interaction

Status: VERIFIED FIXED

(Rhino Graveyard :: Core, defect)

Description

[Igor Bukanov]

Rhino contains API that allows to define in Java getters and setters for JS
properties, see
http://mozilla.org/rhino/apidocs/org/mozilla/javascript/ScriptableObject.html#defineProperty(java.lang.String,%20java.lang.Object,%20java.lang.reflect.Method,%20java.lang.reflect.Method,%20int)

But when the delegator form of the setter for property "someProperty" is used
for object "x" which is a prototype for object "y", then invoking:

y.someProperty = 1

will change the value of someProperty in x leaving y object intact. This is
rather unexpected behavior since it does not follow the standard JS logic which
require in this case to create a new property someProperty in y without changing x.

This form of getters/setters is used to initialize various library objects
lazily which can be used to demonstrate the problem in Rhino shell:

----- test start -----
function X() { }
X.prototype = this;

var x = new X; // this is prototype of x now

//Uncomment the following to enable proper behavior since it will initialize 
//JavaAdapter and replace getter/setter for JavaAdapter property in this 

//this.JavaAdapter;

x.JavaAdapter = 1;


var ok = this.JavaAdapter != 1;
print(ok ? "OK" : "Strange");
----- test end -----

Comment 1

[Igor Bukanov]

Attachment: Fix: follow default JS rules in ScriptableObject.setBySetter if start != this

The patch changes changes logic of a setter with delegator to never invoke it
if the property is accessed via prototype. A similar treatment is applied for a
setter without delegator in the cases when start is not an instance of this
type since this case would show the same behavior of changing prototype
property and not creating a new property in the original object.

Comment 2

[Igor Bukanov]

I committed the patch

Comment 3

[Phil Schwartau]

Verified FIXED using Igor's testcase above -

BEFORE FIX:
[ ] java org.mozilla.javascript.tools.shell.Main -f 205661.js
Strange

AFTER FIX:
[ ] java org.mozilla.javascript.tools.shell.Main -f 205661.js
OK

Comment 4

[Igor Bukanov]

Targeting as resolved against 1.5R5