466939 - getters and setters defined on Array.prototype have incorrect this until you set something on an individual array

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Daniel Friesen]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4 FirePHP/0.2.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4

Any getter you define on Array.prototype gets called with incorrect Arrays in 'this' up until you set a property or getter directly on the array you created.

Reproducible: Always

Steps to Reproduce:
1. Define: Array.prototype.__defineGetter__('first', function() this[0]);
2. Create an array: var arr = ['foo', 'bar', 'baz'];
3. Check: arr.first; // This returns undefined
4. Run: arr.abc = 'def';
5. Check: arr.first; // This now returns 'foo'
Actual Results:  
The first arr.first call returned undefined.

Expected Results:  
The first arr.first call should have returned 'foo'.

I originally encountered this bug when using jslibs: http://code.google.com/p/jslibs/
However I did a test inside of FireBug's console in Firefox and I can confirm that this same bug is present within SpiderMonkey, not just TraceMonkey using jslibs.

I did some extended debugging back in jslibs:
http://stuff.nadir-point.com/foo.js // Code
http://stuff.nadir-point.com/foo.output.txt // My output

The only jslibs dependencies there are Print and LoadModule('jsstd') which is there so I have access to Print. You should be able to substitute in any print function for the method you are using to execute the test and get the same result.

According to this information:
* The getter is always being called.
* However until after you have set something on the individual array, no getter is given the correct array object inside of this.
* Calling a method does not fix the issue like setting something. (does this indicate that it is not an issue with literals not being converted to objects?)

Comment 1

[Daniel Friesen]

Attachment: Testcase file

Comment 2

[Daniel Friesen]

Attachment: My output of the testcase file

Comment 3

[Brendan Eich [:brendan]]

I thought we had a dup of this, but I can't find it. Cc'ing shavarray pals.

/be

Comment 4

[Jason Orendorff [:jorendorff]]

// reduced test case

Array.prototype.__defineGetter__('self', function() this)
if ([].self === Array.prototype)
  print("broken");

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I seem to recall brendan wanting to fix this (there definitely was another bug, though it's eluding me right now) with the same patch as bug 452189.

Comment 6

[Jason Orendorff [:jorendorff]]

Somewhere along the line this got fixed.  Bug 479630 still exists.