188789 2018-08-21 05:39:28 -0700 Fail to throw TypeError when set a getter-only property in Array.prototype.pop 2020-06-07 06:38:22 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED DUPLICATE 201910 P2 Normal --- 1 sunlili webkit-unassigned ashvayka fpizlo ysuzuki oldest_to_newest 1452050 0 sunlili 2018-08-21 05:39:28 -0700 Executing following code : --------------------------------------------- function foo() { var obj = {}; Object.prototype.push = Array.prototype.push; Object.prototype.pop = Array.prototype.pop; var x; Object.defineProperty(obj, "length", {get: function() {x = true; return 5;}}); //call set length while pop,but setter was undefined x = false; try { var len = obj.pop(); } catch (e) { print('caught exception:'); print(e); } print(x); } foo(); print("BT_FLAG"); ----------------------------------------------------- Output should be : caught exception: TypeError: setting getter-only property "length" true BT_FLAG However, output of JavaScriptCore: true BT_FLAG BT_GROUP 2018/8/21 1660054 1 ashvayka 2020-06-07 06:38:22 -0700 r250275 fixed putLength() with unsuccessful [[Set]], including Array.prototype.pop case. test262 coverage: https://github.com/tc39/test262/pull/2463. *** This bug has been marked as a duplicate of bug 201910 ***