Bug 159645
| Summary: | Array.prototype.splice is wrong w.r.t ES6 spec | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Saam Barati <saam> |
| Component: | JavaScriptCore | Assignee: | Saam Barati <saam> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | benjamin, fpizlo, ggaren, gskachkov, joepeck, keith_miller, mark.lam, msaboff, oliver, sukolsak, ysuzuki |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Saam Barati
Specifically, this code is wrong:
```
for (unsigned k = 0; k < deleteCount; ++k) {
JSValue v = getProperty(exec, thisObj, k + begin);
if (UNLIKELY(vm.exception()))
return JSValue::encode(jsUndefined());
if (!v)
continue;
result->putByIndexInline(exec, k, v, true);
if (UNLIKELY(vm.exception()))
return JSValue::encode(jsUndefined());
}
```
We should be calling defineOwnProperty.
See spec:
https://tc39.github.io/ecma262/#sec-array.prototype.splice
and
https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Saam Barati
*** This bug has been marked as a duplicate of bug 171591 ***