Bug 200337 – Can Array.prototype.push.apply() function pass argument of String type?

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: JavaScriptCore

#Testcase:
1 var foo = function(array) {
2     var a = [0,1,2];
3     Array.prototype.push.apply(array, a);
4     print(array.length);
5     print(array);
6 };
7 var str = “asdadc”;
8 foo(str);

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
6
asdadc

#Expected output:
testcase.js:3: TypeError: Cannot assign to read only property 'length' of object '[object String]'

#Description:
According to the ECMAScript-262 standard, a TypeError exception should be thrown when executing the above testcase. However, javascriptCore doesn’t throw any exception but outputs “6” and “asdadc” while other JS engines such as V8, SpiderMonkey throw an exception. According to the ES standard, an exception should be thrown when executing the Set(O, "length", len, true) method, because the string’s length is read-only. So I suspect that it’s a bug of JavaScriptCore.
The references of ECMAScript-262 standard are as follows: 
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push
http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7

[Mark Lam]

Resolved by config change.