170537 2017-04-05 21:27:43 -0700 test262: REGRESSION(r207226): test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property. 2020-08-30 02:16:35 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 200560 P2 Normal --- 1 joepeck webkit-unassigned ashvayka gskachkov mark.lam saam oldest_to_newest 1294794 0 joepeck 2017-04-05 21:27:43 -0700 A few test262 tests fail after: <https://webkit.org/b/163338> Array.prototype.slice should not modify frozen objects <http://trac.webkit.org/r207226> Steps to Reproduce: 1. Check JSTests/test262.yaml expectations for the above file paths (if they are marked as :fail) 2. $ run-jsc-stress-tests JSTests/test262.yaml Notes: - Not sure if these are progressions, but since the tests themselves don't seem to mention freezing anything it seems unexpected. - If this is an actual failure the expectations can be changed to :failDueToOutdatedOrBadTest Failures: > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property. > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: splice@[native code] > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: global code@create-proxy.js:39:37 > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: ERROR: Unexpected exit code: 3 > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: Exception: TypeError: Attempted to assign to readonly property. > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: splice@[native code] > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: global code@create-proxy.js:38:37 > test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: ERROR: Unexpected exit code: 3 1294896 1 saam 2017-04-06 08:58:47 -0700 Looks like it's probably a regression to me. 1683996 2 ashvayka 2020-08-30 02:16:35 -0700 (In reply to Saam Barati from comment #1) > Looks like it's probably a regression to me. It's actually a progression: r207226 is correct to throw a TypeError if Set() fails. In create-proxy.js test262 case, the Set() is invoked on Proxy with another Proxy as its [[ProxyTarget]], which incorrectly returned `false` due to a hack in JSObject::getOwnPropertyDescriptor(). r259800 removed the hack, fixing this test. *** This bug has been marked as a duplicate of bug 200560 ***