[Webkit-unassigned] [Bug 75788] Array.prototype.pop should throw if property is not configurable

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=75788


metaweta at gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |metaweta at gmail.com




--- Comment #1 from metaweta at gmail.com  2012-06-25 11:47:12 PST ---
This is far worse than merely not throwing, which is acceptable outside of strict mode.  The current behavior violates the frozenness invariant:

var a = [1,2,3];
Object.freeze(a);
a.pop(); // returns 3
a; // [1,2]
Object.isFrozen(a); // true

It's a security bug and should be escalated.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.