Bug 189470
| Summary: | Fail to throw TypeError when setting function.length in Array.prototype.unshift | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | sunlili |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | ashvayka, fpizlo, ysuzuki |
| Priority: | P2 | ||
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
sunlili
Hello, executing following code:
-----------------------------------
var f = function func1() {};
var a=[];
print(f.length);
a.unshift.call(f,1,2,3)
print(f.length);
-----------------------------------
Output of jsc is:
0
0
However, since function's length property is readonly, a TypeError should be thrown in unshift() execution.
BT group
2018.09.10
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Shvayka
(In reply to sunlili from comment #0)
> However, since function's length property is readonly, a TypeError should be
> thrown in unshift() execution.
r250275 fixed putLength() with unsuccessful [[Set]], including Array.prototype.unshift case.
test262 coverage: https://github.com/tc39/test262/pull/2463.
*** This bug has been marked as a duplicate of bug 201910 ***