313570 - length property of objects whose prototype chain includes a function is undefined

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Yuh-Ruey Chen]

While trying to develop a workaround for bug 313568, I discovered that an object whose prototype chain has a function object is undefined and can't be changed. For ex:

function tmp() {}
tmp.prototype = function(a, b, c) {};
var obj = new tmp();
//obj.length is undefined
obj.length = 10;
//obj.length is still undefined

Also, obj.hasOwnProperty('length') returns true.

IE always outputs the original function's length, which would be 3 in this case and is also immutable. Opera allows obj.length to be changed.

Comment 1

[Brendan Eich [:brendan]]

Taking.  JSPROP_SHARED is deep when used with JSPROP_PERMANENT, which makes hasOwnProperty true all the way down the delegation chain (it's meant to apply only to function instances, so they each seem to have a 'length' direct property even though they are all delegating to Function.prototype).

The inability to get o.length and see the prototype's arity (3 in your example) is a somewhat separate (or separable) bug.  It might be the thing to fix first.

/be

Comment 2

[Yuh-Ruey Chen]

Actually, the length property being immutable may be part of the spec. [[Put]] calls [[CanPut]] as its first step and [[CanPut]] seems to say that if any property in the prototype chain is ReadOnly, return false.

Comment 3

[Brendan Eich [:brendan]]

(In reply to comment #2)
> Actually, the length property being immutable may be part of the spec. [[Put]]
> calls [[CanPut]] as its first step and [[CanPut]] seems to say that if any
> property in the prototype chain is ReadOnly, return false.

Right, so bug 313568 is invalid, and the part of this bug that wants to set obj.length = 10 is invalid too -- but the bits about obj.length being undefined, and obj.hasOwnProperty('length') being true are valid.

/be

Comment 4

[Bob Clary [:bc] (inactive)]

Checking in regress-313570.js;
/cvsroot/mozilla/js/tests/ecma_3/Function/regress-313570.js,v  <--  regress-313570.js
initial revision: 1.1
done

Comment 5

[Brendan Eich [:brendan]]

Attachment: proposed fix

Note the lack of fun_setProperty -- all the built-in properties are readonly, so we know that if fun_getProperty is being called, there is no shadowing property in a more direct object along the prototype chain, therefore we should find the first function object on the chain.

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 205451 [details] [diff] [review]
proposed fix

r=mrbkap

Comment 7

[Mike Shaver (:shaver emeritus)]

Comment on attachment 205451 [details] [diff] [review]
proposed fix

sr=shaver.  silly special function objects!

Comment 8

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

with 20051217 builds on win/mac/linux

<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=ecma_3/Function/regress-313570.js;language=language;javascript>

BUGNUMBER: 313570
STATUS: length of objects whose prototype chain includes a function
FAILED!: length of objects whose prototype chain includes a function: inherited
FAILED!: Expected value 'false', Actual value 'true'
FAILED!: 

Comment 10

[Brendan Eich [:brendan]]

Restoring FIXED mark -- Bob, the hasOwnProperty result is expected given the design of SpiderMonkey, and it's independent of this bug or its fix.  Could you please spin out a new bug?  Thanks,

/be

Comment 11

[Bob Clary [:bc] (inactive)]

filed Bug 320854

Comment 12

[Bob Clary [:bc] (inactive)]

verified on trunk windows/linux/mac