When a property is deleted, and a getter/setter of the same name is create, another unrelated property will be deleted as well: var obj = { a:1, b:2, c:3, d:4, e:5 } delete obj.c; obj.__defineGetter__("c", function() { return 3 }); /* obj.e will be deleted!*/ My testing seems to indicate that the latest-defined property is the one that gets deleted; mistakenly replaced by the getter/setter perhaps?
Created attachment 17163 [details] Test case
Created attachment 17169 [details] Working test case The test case provided throws a JavaScript exception. I've attached a fixed version that demonstrates the issue.
This is a regression from WebKit in Leopard.
"git bisect" narrowed this down to regressing in r27487 (http://trac.webkit.org/projects/webkit/changeset/27487). Running with hashtable consistency checks on does not turn up anything useful. CC'ing Darin as he was responsible for the change that introduced this regression.
Created attachment 17171 [details] Test case in a testkjs-friendly form This is the same test case in a testkjs-friendly form. It also prints out a handy SUCCESS or FAIL at the end.
Created attachment 17173 [details] patch
Comment on attachment 17173 [details] patch r=me. Are we considering 4k large these days?
Committed revision 27678.