1267041 - Setting Function.prototype.prototype causes weird behaviour

Status: RESOLVED DUPLICATE of bug 1263525

(Core :: JavaScript Engine, defect, P2)

Description

[Hallvord R. M. Steen [:hallvors]]

Attachment: wc2440.htm - TC

Kayak.com depends on among others the Dean Edwards base library. For whatever reason, Dean has this line of code among his utilities:

Function.prototype.prototype = {};

This triggers a regression that causes some weird behaviour in current nightly when other JS on the Kayak site try to use Array.prototype.slice.call(arguments) to get an array from an arguments object. What you get is classified as an Array but actually its __proto__ is Object and it doesn't have normal array methods. See TC.

Moved from https://webcompat.com/issues/2440

Comment 1

[Tom S [:evilpie]]

Ah, got it. ArraySpeciesCreate calls std_Array when |originalArray| is not array. However in the spec this doesn't call the default array constructor, but ArrayCreate. The default array constructor (22.1.1) however uses GetPrototypeFromConstructor, which would end up using this .prototype property. 
So the summarize: Using std_Array is wrong, we should probably use something like NewDenseArray?

Comment 2

[Tom S [:evilpie]]

Sorry I forgot: Hallvord, thanks for this awesome test case!

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Arai-san mentions this should be turned s-s. (ref bug 1263525)

Comment 4

[Tooru Fujisawa [:arai]]

This is basically a dupe of bug 1263525, but might be better keeping this bug to track the issue on the website.
now that we have an actual website that hit the issue, we should fix it quickly.

Comment 5

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hallvord, the fix from bug 1263525 landed on m-c on 04-26 (https://bugzilla.mozilla.org/show_bug.cgi?id=1263525#c13). Would you be able to validate that the issue with kayak.com is now fixed as expected on a latest Nightly build? Thanks!

Comment 6

[Hallvord R. M. Steen [:hallvors]]

Tested, works :) Let's call this a dup of https://bugzilla.mozilla.org/show_bug.cgi?id=1263525