Bug 1989978 Comment 2 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Good find, thanks for the report! It looks like the `StoreSlotByIteratorIndex` optimization can incorrectly mutate non-writable data properties. The JSON code depends on the `rawJSON` property not changing, because it's defined non-writable and non-configurable.

Here's a similar test that doesn't use JSON:
```
// Fails with --no-threads, passes with --no-ion
function opt(a) {
  for (const it in a) {
    a[it] = 5;
  }
}
const obj = {};
Object.defineProperty(obj, "x", {value: 1, enumerable: true, writable: false});
for (let i = 0; i < 2000; i++) {
  opt(obj);
}
assertEq(obj.x, 1);
```
We should also make sure we handle fuse properties correctly.
Revision 1 by
on 
Good find, thanks for the report! It looks like the `StoreSlotByIteratorIndex` optimization can incorrectly mutate non-writable data properties. The JSON code depends on the `rawJSON` property not changing, because it's defined non-writable and non-configurable.

Here's a similar test that doesn't use JSON:
```js
// Fails with --no-threads, passes with --no-ion
function opt(a) {
  for (const it in a) {
    a[it] = 5;
  }
}
const obj = {};
Object.defineProperty(obj, "x", {value: 1, enumerable: true, writable: false});
for (let i = 0; i < 2000; i++) {
  opt(obj);
}
assertEq(obj.x, 1);
```
We should also make sure we handle fuse properties correctly.

Back to Bug 1989978 Comment 2