Bug 163302 - Array.prototype.concat should not modify frozen objects
Summary: Array.prototype.concat should not modify frozen objects
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
Depends on:
Reported: 2016-10-11 15:26 PDT by Mark Lam
Modified: 2016-10-11 16:28 PDT (History)
8 users (show)

See Also:

proposed patch. (8.44 KB, patch)
2016-10-11 15:36 PDT, Mark Lam
fpizlo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2016-10-11 15:26:58 PDT
The ES6 spec for Array.prototype.concat states that it uses the CreateDataPropertyOrThrow() to add items to the result array.  The spec for CreateDataPropertyOrThrow states:

"This abstract operation creates a property whose attributes are set to the same defaults used for properties created by the ECMAScript language assignment operator. Normally, the property will not already exist. If it does exist and is not configurable or if O is not extensible, [[DefineOwnProperty]] will return false causing this operation to throw a TypeError exception."

Since the properties of frozen objects are not extensible nor configurable, Array.prototype.concat should fail to write to the result array if it is frozen.

Ref: https://tc39.github.io/ecma262/#sec-array.prototype.concat, https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow, and https://tc39.github.io/ecma262/#sec-createdataproperty.
Comment 1 Mark Lam 2016-10-11 15:36:58 PDT
Created attachment 291307 [details]
proposed patch.
Comment 2 Mark Lam 2016-10-11 15:53:59 PDT
Thanks for the review.  I'm going to change the attached test to only runFTLNoCJIT before landing.  It doesn't need to run with other configurations.
Comment 3 Mark Lam 2016-10-11 16:28:51 PDT
Landed in r207178: <http://trac.webkit.org/r207178>.