test262/test/language/expressions/tagged-template/template-object.js And other test262 tests. Boils down to: var arr = []; Object.freeze(arr); arr.length = "test"; assert( arr.length === 0 ); Expected: No runtime exception and length doesn't change. Actual: Exception: RangeError: Invalid array length Notes: - Chrome, Firefox, and Edge all do not throw an exception here - Seems JavaScriptCore has a JSArray::put fast path that doesn't check the is array writable before attempting to set the length Spec: 12.15.4 Runtime Semantics: Evaluation https://tc39.github.io/ecma262/#sec-assignment-operators-runtime-semantics-evaluation > 1. If LeftHandSideExpression is neither an ObjectLiteral nor an ArrayLiteral, then > ... > f. Perform ? PutValue(lref, rval). 6.2.4.2 PutValue ( V, W ) https://tc39.github.io/ecma262/#sec-putvalue > 6. Else if IsPropertyReference(V) is true, then > ... > b. Let succeeded be ? base.[[Set]](GetReferencedName(V), W, GetThisValue(V)). > c. If succeeded is false and IsStrictReference(V) is true, throw a TypeError exception. > d. Return. 9.1.9 [[Set]] ( P, V, Receiver ) https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-set-p-v-receiver > 1. Return ? OrdinarySet(O, P, V, Receiver). 9.1.9.1 OrdinarySet ( O, P, V, Receiver ) https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-set-p-v-receiver > 4. If IsDataDescriptor(ownDesc) is true, then > a. If ownDesc.[[Writable]] is false, return false. > ... > d. If existingDescriptor is not undefined, then > ... > iv) Return ? Receiver.[[DefineOwnProperty]](P, valueDesc). 4.d.iv This DefineOwnProperty would throw a range error except 4.a should already have returned if this is not writable.
Created attachment 307205 [details] [PATCH] Proposed Fix
Comment on attachment 307205 [details] [PATCH] Proposed Fix Attachment 307205 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/3542628 New failing tests: webrtc/multi-video.html
Created attachment 307210 [details] Archive of layout-test-results from ews104 for mac-elcapitan-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews104 Port: mac-elcapitan-wk2 Platform: Mac OS X 10.11.6
Comment on attachment 307205 [details] [PATCH] Proposed Fix Attachment 307205 [details] did not pass mac-debug-ews (mac): Output: http://webkit-queues.webkit.org/results/3542641 New failing tests: workers/wasm-long-compile-many.html
Created attachment 307211 [details] Archive of layout-test-results from ews117 for mac-elcapitan The attached test failures were seen while running run-webkit-tests on the mac-debug-ews. Bot: ews117 Port: mac-elcapitan Platform: Mac OS X 10.11.6
Comment on attachment 307205 [details] [PATCH] Proposed Fix LGTM
Comment on attachment 307205 [details] [PATCH] Proposed Fix Test failures are unrelated.
Comment on attachment 307205 [details] [PATCH] Proposed Fix Clearing flags on attachment: 307205 Committed r215401: <http://trac.webkit.org/changeset/215401>
All reviewed patches have been landed. Closing bug.