Closed Bug 469937 Opened 16 years ago Closed 16 years ago

Properties without DontEnum are sometimes not enumerated

Categories

(Rhino Graveyard :: Core, defect)

defect
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: heycam, Assigned: szegedia)

Details

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20081214 Minefield/3.2a1pre
Build Identifier: Rhino 1.7 release 3 PRERELEASE 2008 12 17

Certain sequences of operations on an object can cause a property to be not placed in the ordered linked list of properties.  Specifically this happens when:

  * A property p1 with slot index X is created
  * A property p2 with slot index Y (where X != Y) is created
  * Property p2 is deleted
  * The object's properties are enumerated
  * A property p3 with slot index Y is created

After this, p3 is on the object, but won't be enumerated.


Reproducible: Always

Steps to Reproduce:
Evaluate the following script:

o = { }
o.PageLeft = 1
o.Rect2 = 6
delete o.Rect2
for (var p in o);
o.Rect3 = 7
found = false
for (var p in o) if (p == 'Rect3') found = true
java.lang.System.out.println("found = " + found)

Actual Results:  
Prints out "found = false".


Expected Results:  
Print out "found = true".
The bug is that lastAdded is not updated when the final slot of the ordered property linked list is removed due to it having wasDeleted == true.  If this happens, then when a property slot is created after this, it will be assigned to lastAdded.orderedNext inside accessSlot(), resulting in it not being reached when traversing the list starting from firstAdded the next time the properties are enumerated.

The patch updates getIds(boolean) to ensure lastAdded remains pointing to the last slot in the list.
Attachment #353354 - Flags: review?
Actually, disregard the stuff about the slot indexes in the first comment, that's a red herring.  The situation the bug occurs in is just:

  * Start with an object that has at least one property and which hasn't had
    its most recently added property (or properties) deleted
  * Create a property p1
  * Delete property p1
  * Enumerate the object's properties
  * Create property p2 (where p2 ! p1)

Then p2 won't be enumerated.
Committed to CVS HEAD; also added a unit test (confirmed that it failed before the patch and it passes after the patch).

cvs ci -m "Fix (and testcase) for Bug #469937 "Properties without DontEnum are sometimes not enumerated"" -l "/tests/ecma_3/Regress/regress-469937.js"
    RCS file: /cvsroot/mozilla/js/tests/ecma_3/Regress/regress-469937.js,v
    done
    Checking in ecma_3/Regress/regress-469937.js;
    /cvsroot/mozilla/js/tests/ecma_3/Regress/regress-469937.js,v  <--  regress-469937.js
    initial revision: 1.1
    done
ok (took 0:11.235)
***

***
cvs ci -m "Fix (and testcase) for Bug #469937 "Properties without DontEnum are sometimes not enumerated"" -l "/Rhino/src/org/mozilla/javascript/ScriptableObject.java"
    Checking in src/org/mozilla/javascript/ScriptableObject.java;
    /cvsroot/mozilla/js/rhino/src/org/mozilla/javascript/ScriptableObject.java,v  <--  ScriptableObject.java
    new revision: 1.142; previous revision: 1.141
    done
ok (took 0:05.722)
***
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Assignee: nobody → szegedia
Fix propagated to 1.7R2 release branch
Attachment #353354 - Flags: review?
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: