Bug 188789 – Fail to throw TypeError when set a getter-only property in Array.prototype.pop

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

Executing following code :
---------------------------------------------
function foo()
{
    var obj = {};

    Object.prototype.push = Array.prototype.push;
    Object.prototype.pop = Array.prototype.pop;
    var x;
    Object.defineProperty(obj, "length", {get: function() {x = true; return 5;}});
    //call set length while pop,but setter was undefined
    x = false;

    try
    {
        var len = obj.pop();
    }
    catch (e)
    {
        print('caught exception:');
        print(e);
    }
    print(x);
}
foo();

print("BT_FLAG");
-----------------------------------------------------

Output should be :
caught exception:
TypeError: setting getter-only property "length"
true
BT_FLAG

However, output of JavaScriptCore:
true
BT_FLAG



BT_GROUP
2018/8/21

[Alexey Shvayka]

r250275 fixed putLength() with unsuccessful [[Set]], including Array.prototype.pop case.
test262 coverage: https://github.com/tc39/test262/pull/2463.

*** This bug has been marked as a duplicate of bug 201910 ***