Changeset 247065 in webkit

Timestamp:

Jul 2, 2019 11:46:42 AM (5 years ago)

Author:

keith_miller@apple.com

Message:

Frozen Arrays length assignment should throw in strict mode
​https://bugs.webkit.org/show_bug.cgi?id=199365

Reviewed by Yusuke Suzuki.

JSTests:

• stress/frozen-array-length-should-throw-strict.js: Added.

(test):

Source/JavaScriptCore:

• runtime/JSArray.cpp:

(JSC::JSArray::put):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/frozen-array-length-should-throw-strict.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSArray.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-07-02  Keith Miller  <keith_miller@apple.com>
+
+        Frozen Arrays length assignment should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=199365
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/frozen-array-length-should-throw-strict.js: Added.
+        (test):
+
 2019-07-01  Justin Michaud  <justin_michaud@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-07-02  Keith Miller  <keith_miller@apple.com>
+
+        Frozen Arrays length assignment should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=199365
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+
 2019-07-02  Paulo Matos  <pmatos@linki.tools>
 

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -287 +287 @@
 
     if (propertyName == vm.propertyNames->length) {
-        if (!thisObject->isLengthWritable())
+        if (!thisObject->isLengthWritable()) {
+            if (slot.isStrictMode())
+                throwTypeError(exec, scope, "Array length is not writable"_s);
             return false;
+        }
+
         unsigned newLength = value.toUInt32(exec);
         RETURN_IF_EXCEPTION(scope, false);