In strict mode, assigning to `.length` on a Frozen Array silently fails, when it should raise a TypeError. I noticed this when I realized I could assign strings.length from within the tag function of a Tagged Template. Example: const a = Object.freeze(['a']); // this should throw, but it doesn't: a.length = 2; console.log(a.length); // 1 // this throws correctly: // a.x = 2; Reproduction: https://jsbin.com/fecosoh/edit?html,console
<rdar://problem/52514370>
Created attachment 373339 [details] Patch
Comment on attachment 373339 [details] Patch r=me
Thanks for the report! This patch should fix this.
The commit-queue encountered the following flaky tests while processing attachment 373339 [details]: imported/w3c/web-platform-tests/xhr/event-error-order.sub.html bug 192363 (authors: cdumez@apple.com and youennf@gmail.com) imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-non-broken.html bug 183294 (authors: cdumez@apple.com and youennf@gmail.com) imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/events/020.html bug 199414 (author: youennf@gmail.com) The commit-queue is continuing to process your patch.
Comment on attachment 373339 [details] Patch Clearing flags on attachment: 373339 Committed r247065: <https://trac.webkit.org/changeset/247065>
All reviewed patches have been landed. Closing bug.