Bug 159645

Summary: Array.prototype.splice is wrong w.r.t ES6 spec
Product: WebKit Reporter: Saam Barati <sbarati>
Component: JavaScriptCoreAssignee: Saam Barati <sbarati>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: benjamin, fpizlo, ggaren, gskachkov, joepeck, keith_miller, mark.lam, msaboff, oliver, sukolsak, ysuzuki
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Saam Barati 2016-07-11 14:44:06 PDT
Specifically, this code is wrong:
```
            for (unsigned k = 0; k < deleteCount; ++k) {
                JSValue v = getProperty(exec, thisObj, k + begin);
                if (UNLIKELY(vm.exception()))
                    return JSValue::encode(jsUndefined());
                if (!v)
                    continue;
                result->putByIndexInline(exec, k, v, true);
                if (UNLIKELY(vm.exception()))
                    return JSValue::encode(jsUndefined());
            }
```
We should be calling defineOwnProperty.
See spec:
https://tc39.github.io/ecma262/#sec-array.prototype.splice
and
https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow
Comment 1 Saam Barati 2017-05-03 16:27:12 PDT

*** This bug has been marked as a duplicate of bug 171591 ***