159645 2016-07-11 14:44:06 -0700 Array.prototype.splice is wrong w.r.t ES6 spec 2017-05-03 16:27:12 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 171591 P2 Normal --- 1 saam saam benjamin fpizlo ggaren gskachkov joepeck keith_miller mark.lam msaboff oliver sukolsak ysuzuki oldest_to_newest 1209814 0 saam 2016-07-11 14:44:06 -0700 Specifically, this code is wrong: ``` for (unsigned k = 0; k < deleteCount; ++k) { JSValue v = getProperty(exec, thisObj, k + begin); if (UNLIKELY(vm.exception())) return JSValue::encode(jsUndefined()); if (!v) continue; result->putByIndexInline(exec, k, v, true); if (UNLIKELY(vm.exception())) return JSValue::encode(jsUndefined()); } ``` We should be calling defineOwnProperty. See spec: https://tc39.github.io/ecma262/#sec-array.prototype.splice and https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow 1304361 1 saam 2017-05-03 16:27:12 -0700 *** This bug has been marked as a duplicate of bug 171591 ***