Bug 170878 – test262: test262/test/language/expressions/tagged-template/template-object.js

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Joseph Pecoraro]

test262/test/language/expressions/tagged-template/template-object.js

And other test262 tests.

Boils down to:
var arr = [];
Object.freeze(arr);
arr.length = "test";
assert( arr.length === 0 );

Expected:
No runtime exception and length doesn't change.

Actual:
Exception: RangeError: Invalid array length

Notes:
- Chrome, Firefox, and Edge all do not throw an exception here
- Seems JavaScriptCore has a JSArray::put fast path that doesn't check the is array writable before attempting to set the length

Spec:

12.15.4 Runtime Semantics: Evaluation
https://tc39.github.io/ecma262/#sec-assignment-operators-runtime-semantics-evaluation

> 1. If LeftHandSideExpression is neither an ObjectLiteral nor an ArrayLiteral, then
>    ...
>    f. Perform ? PutValue(lref, rval).

6.2.4.2 PutValue ( V, W )
https://tc39.github.io/ecma262/#sec-putvalue

> 6. Else if IsPropertyReference(V) is true, then
>     ...
>     b. Let succeeded be ? base.[[Set]](GetReferencedName(V), W, GetThisValue(V)).
>     c. If succeeded is false and IsStrictReference(V) is true, throw a TypeError exception.
>     d. Return.

9.1.9 [[Set]] ( P, V, Receiver )
https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-set-p-v-receiver

> 1. Return ? OrdinarySet(O, P, V, Receiver).

9.1.9.1 OrdinarySet ( O, P, V, Receiver )
https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-set-p-v-receiver

> 4. If IsDataDescriptor(ownDesc) is true, then
>      a. If ownDesc.[[Writable]] is false, return false.
>      ...
>      d. If existingDescriptor is not undefined, then
>          ...
>         iv) Return ? Receiver.[[DefineOwnProperty]](P, valueDesc).

4.d.iv This DefineOwnProperty would throw a range error except 4.a should already have returned if this is not writable.

[Joseph Pecoraro]

Created attachment 307205 [details]
[PATCH] Proposed Fix

[Build Bot]

Comment on attachment 307205 [details]
[PATCH] Proposed Fix

Attachment 307205 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3542628

New failing tests:
webrtc/multi-video.html

[Build Bot]

Created attachment 307210 [details]
Archive of layout-test-results from ews104 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews104  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Build Bot]

Comment on attachment 307205 [details]
[PATCH] Proposed Fix

Attachment 307205 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/3542641

New failing tests:
workers/wasm-long-compile-many.html

[Build Bot]

Created attachment 307211 [details]
Archive of layout-test-results from ews117 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews117  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Saam Barati]

Comment on attachment 307205 [details]
[PATCH] Proposed Fix

LGTM

[Joseph Pecoraro]

Comment on attachment 307205 [details]
[PATCH] Proposed Fix

Test failures are unrelated.

[WebKit Commit Bot]

Comment on attachment 307205 [details]
[PATCH] Proposed Fix

Clearing flags on attachment: 307205

Committed r215401: <http://trac.webkit.org/changeset/215401>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.