Bug 170537 – test262: REGRESSION(r207226): test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property.

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Joseph Pecoraro]

A few test262 tests fail after:
<https://webkit.org/b/163338> Array.prototype.slice should not modify frozen objects
<http://trac.webkit.org/r207226>

Steps to Reproduce:
1. Check JSTests/test262.yaml expectations for the above file paths (if they are marked as :fail)
2. $ run-jsc-stress-tests JSTests/test262.yaml

Notes:
- Not sure if these are progressions, but since the tests themselves don't seem to mention freezing anything it seems unexpected.
- If this is an actual failure the expectations can be changed to :failDueToOutdatedOrBadTest

Failures:
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: Exception: TypeError: Attempted to assign to readonly property.
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: splice@[native code]
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: global [e-mail]:39:37
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default-strict: ERROR: Unexpected exit code: 3
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: Exception: TypeError: Attempted to assign to readonly property.
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: splice@[native code]
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: global [e-mail]:38:37
> test262.yaml/test262/test/built-ins/Array/prototype/splice/create-proxy.js.default: ERROR: Unexpected exit code: 3

[Saam Barati]

Looks like it's probably a regression to me.

[Alexey Shvayka]

(In reply to Saam Barati from comment #1)
> Looks like it's probably a regression to me.

It's actually a progression: r207226 is correct to throw a TypeError if Set() fails.
In create-proxy.js test262 case, the Set() is invoked on Proxy with another Proxy as its [[ProxyTarget]], which incorrectly returned `false` due to a hack in JSObject::getOwnPropertyDescriptor().
r259800 removed the hack, fixing this test.

*** This bug has been marked as a duplicate of bug 200560 ***