Bug 170537 - test262: REGRESSION(r207226): test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property.
Summary: test262: REGRESSION(r207226): test262/test/built-ins/Array/prototype/splice/c...
Status: RESOLVED DUPLICATE of bug 200560
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-04-05 21:27 PDT by Joseph Pecoraro
Modified: 2020-08-30 02:16 PDT (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Joseph Pecoraro 2017-04-05 21:27:43 PDT 
A few test262 tests fail after:
<https://webkit.org/b/163338> Array.prototype.slice should not modify frozen objects
<http://trac.webkit.org/r207226>

Steps to Reproduce:
1. Check JSTests/test262.yaml expectations for the above file paths (if they are marked as :fail)
2. $ run-jsc-stress-tests JSTests/test262.yaml

Notes:
- Not sure if these are progressions, but since the tests themselves don't seem to mention freezing anything it seems unexpected.
- If this is an actual failure the expectations can be changed to :failDueToOutdatedOrBadTest

Failures:
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property.
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: splice@[native code]
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: global code@create-proxy.js:39:37
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: ERROR: Unexpected exit code: 3
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: Exception: TypeError: Attempted to assign to readonly property.
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: splice@[native code]
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: global code@create-proxy.js:38:37
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: ERROR: Unexpected exit code: 3
Comment 1 Saam Barati 2017-04-06 08:58:47 PDT 
Looks like it's probably a regression to me.
Comment 2 Alexey Shvayka 2020-08-30 02:16:35 PDT 
(In reply to Saam Barati from comment #1)
> Looks like it's probably a regression to me.

It's actually a progression: r207226 is correct to throw a TypeError if Set() fails.
In create-proxy.js test262 case, the Set() is invoked on Proxy with another Proxy as its [[ProxyTarget]], which incorrectly returned `false` due to a hack in JSObject::getOwnPropertyDescriptor().
r259800 removed the hack, fixing this test.

*** This bug has been marked as a duplicate of bug 200560 ***