Bug 199365 - Frozen Arrays length assignment should throw in strict mode
Summary: Frozen Arrays length assignment should throw in strict mode
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari Technology Preview
Hardware: All All
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-07-01 07:55 PDT by Jason Miller
Modified: 2019-07-02 11:46 PDT (History)
11 users (show)

See Also:


Attachments
Patch (2.80 KB, patch)
2019-07-02 10:47 PDT, Keith Miller
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Miller 2019-07-01 07:55:48 PDT
In strict mode, assigning to `.length` on a Frozen Array silently fails, when it should raise a TypeError.
I noticed this when I realized I could assign strings.length from within the tag function of a Tagged Template.

Example:

    const a = Object.freeze(['a']);
    
    // this should throw, but it doesn't:
    a.length = 2;
    console.log(a.length);  // 1
    
    // this throws correctly:
    // a.x = 2;


Reproduction:
https://jsbin.com/fecosoh/edit?html,console
Comment 1 Radar WebKit Bug Importer 2019-07-02 03:45:47 PDT
<rdar://problem/52514370>
Comment 2 Keith Miller 2019-07-02 10:47:10 PDT
Created attachment 373339 [details]
Patch
Comment 3 Yusuke Suzuki 2019-07-02 10:48:20 PDT
Comment on attachment 373339 [details]
Patch

r=me
Comment 4 Keith Miller 2019-07-02 10:49:17 PDT
Thanks for the report! This patch should fix this.
Comment 5 WebKit Commit Bot 2019-07-02 11:46:02 PDT
The commit-queue encountered the following flaky tests while processing attachment 373339 [details]:

imported/w3c/web-platform-tests/xhr/event-error-order.sub.html bug 192363 (authors: cdumez@apple.com and youennf@gmail.com)
imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-non-broken.html bug 183294 (authors: cdumez@apple.com and youennf@gmail.com)
imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/events/020.html bug 199414 (author: youennf@gmail.com)
The commit-queue is continuing to process your patch.
Comment 6 WebKit Commit Bot 2019-07-02 11:46:49 PDT
Comment on attachment 373339 [details]
Patch

Clearing flags on attachment: 373339

Committed r247065: <https://trac.webkit.org/changeset/247065>
Comment 7 WebKit Commit Bot 2019-07-02 11:46:51 PDT
All reviewed patches have been landed.  Closing bug.