#version: d940b47 #Testcase var a=[1,2]; Object.freeze(a); var b=a.push(); print(b); #Command: ./webkit/WebKitBuild/Release/bin/jsc testcase.js #Output: 2 #Expected output: TypeError: "length" is read-only # Description When executing this test case, a is frozen in the second line, so an error should be thrown when executing Array.prototype.push, but JavaScriptCore outputs normally.
setLength should throw an error even if it is setting the same length if length is readonly. This bug does not break the invariant of freezing (error will not happen only when the setting length equals to the existing length.) But it is strictly speaking not aligned to the spec. var a=[1,2]; Object.freeze(a); a.push(2); // Throwing an error correctly since it is pushing a value and changing length actually.
<rdar://problem/74059121>
Created attachment 450997 [details] Patch
Comment on attachment 450997 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=450997&action=review r=me > Source/JavaScriptCore/ChangeLog:13 > + a) it's the only callee of setLengthWithArrayStorage() that performs [[DefineOwnProperty]], callee -> caller
Comment on attachment 450997 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=450997&action=review > JSTests/stress/array-prototype-methods-set-length.js:98 > + Array.defineProperty(testObject, "length", { writable: false }); Oops, of course it throws, will fix. I will tighten expected error messages in a follow-up, which will make read-only "length" error messages consistent.
Committed r289164 (246860@trunk): <https://commits.webkit.org/246860@trunk>
(In reply to Saam Barati from comment #4) > Comment on attachment 450997 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=450997&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:13 > > + a) it's the only callee of setLengthWithArrayStorage() that performs [[DefineOwnProperty]], > > callee -> caller Fixed, and the tests too. Also, exporting some of them to test262 so the V8 team would fix the bug as well: https://github.com/tc39/test262/pull/3400. Thanks Saam!