Issue metadata
Sign in to add a comment
|
Object.prototype.hasOwnProperty errors since Chrome 55 |
||||||||||||||||||||||||
Issue description
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36
Steps to reproduce the problem:
0. Create an object with a key greater or equal to 1024, a negative int. Test the existence of the negative key using hasOwnProperty.
1. GOOD
var foo = {};
foo[-1] = 'foo';
foo[1024] = 'bar';
Object.prototype.hasOwnProperty.call(foo, -1); // false
2. BAD
var foo = {};
foo[-1] = 'foo';
foo[1023] = 'bar';
Object.prototype.hasOwnProperty.call(foo, -1); // true
What is the expected behavior?
hasOwnProperty should return true if the key is present, even if the key is negative and there's another key greater or equal to 1024.
What went wrong?
hasOwnProperty returns false even though the key is present.
Works in Chrome 54, doesn't work in Chrome 55
Did this work before? Yes 54
Chrome version: 55.0.2883.75 Channel: n/a
OS Version:
Flash Version:
,
Dec 15 2016
,
Dec 15 2016
Able to reproduce the issue on Win 10,Ubuntu 14.04 and Mac 10.11.6 using 55.0.2883.87. Reverse Bisect Info: ============= Good:57.0.2950.0 Bad :57.0.2951.0 You are probably looking for a change made after 438143 (known good), but no later than 438144 (first known bad). CHANGELOG URL: https://chromium.googlesource.com/chromium/src/+log/e882052d97ffbcfddca3a5af0dc6d0f709d95e02..d0a3a61c8c01a5091760967dce24a5f2dd18e3a1 Fixed in : https://chromium.googlesource.com/v8/v8/+/bb753b6dd72e0d132456983248c8f695a692f25d jkummerow@:It looks similar to Issue 673008 , and verified today. Could you please merge it to M56 & M55 if its needed.
,
Dec 15 2016
,
Dec 15 2016
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by tkent@chromium.org
, Dec 14 2016Labels: -Pri-2 Needs-Bisect Pri-1