186992 2018-06-24 23:54:32 -0700 Different output compared with other JS engines 2020-05-07 15:40:19 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED DUPLICATE 184267 https://bugs.webkit.org/show_bug.cgi?id=186991 https://bugs.webkit.org/show_bug.cgi?id=186993 P2 Normal --- 1 sunlili webkit-unassigned ashvayka sunlili ysuzuki oldest_to_newest 1435995 0 sunlili 2018-06-24 23:54:32 -0700 Hello, The following code behaves incorrectly (inconsistent with the standard and other engines). arr0 = [ 1, 2, 3 ]; arr1 = [ 4, 5, 6 ]; handler1 = { get: function (oTarget, sKey) { print('arg ' + '1' + ':get ' + sKey.toString()); if (sKey.toString() == 'Symbol(Symbol.isConcatSpreadable)') { return true; } if (sKey.toString() == 'length') { arr1[0] = { 0: 'a', true: 'b', 2: 'c' }; } if (Number(sKey.toString()) != NaN) { arr0[1] = [ 1, 2, 3 ]; arr0[2] = {}; return false; } return Reflect.get(oTarget, sKey); }, has: function (oTarget, sKey) { print('arg ' + '1' + ':has ' + sKey.toString()); if (Number(sKey.toString()) != NaN) { return [ 1, 2, 3 ]; } return Reflect.has(oTarget, sKey); } }; var proxy1 = new Proxy(arr1, handler1); arr2 = Array.prototype.concat.call(arr0, proxy1); print(arr2); Output is: arg 1:get Symbol(Symbol.isConcatSpreadable) arg 1:get Symbol(Symbol.isConcatSpreadable) arg 1:get length 1,2,3 However, it should be: arg 1:get Symbol(Symbol.isConcatSpreadable) arg 1:get length 1,2,3 1650385 1 ashvayka 2020-05-07 15:40:13 -0700 (In reply to sunlili from comment #0) > However, it should be: > arg 1:get Symbol(Symbol.isConcatSpreadable) > arg 1:get length > 1,2,3 As of r232261, JSC outputs as expected. *** This bug has been marked as a duplicate of bug 184267 ***