Bug 200337 - Can Array.prototype.push.apply() function pass argument of String type?
Summary: Can Array.prototype.push.apply() function pass argument of String type?
Status: RESOLVED CONFIGURATION CHANGED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: PC Linux
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-01 00:35 PDT by yaohouyou
Modified: 2019-10-28 13:31 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description yaohouyou 2019-08-01 00:35:03 PDT
#Testcase:
1 var foo = function(array) {
2     var a = [0,1,2];
3     Array.prototype.push.apply(array, a);
4     print(array.length);
5     print(array);
6 };
7 var str = “asdadc”;
8 foo(str);

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
6
asdadc

#Expected output:
testcase.js:3: TypeError: Cannot assign to read only property 'length' of object '[object String]'

#Description:
According to the ECMAScript-262 standard, a TypeError exception should be thrown when executing the above testcase. However, javascriptCore doesn’t throw any exception but outputs “6” and “asdadc” while other JS engines such as V8, SpiderMonkey throw an exception. According to the ES standard, an exception should be thrown when executing the Set(O, "length", len, true) method, because the string’s length is read-only. So I suspect that it’s a bug of JavaScriptCore.
The references of ECMAScript-262 standard are as follows: 
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push
http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7
Comment 1 Mark Lam 2019-10-28 13:31:02 PDT
Resolved by config change.