[Webkit-unassigned] [Bug 188789] New: Fail to throw TypeError when set a getter-only property in Array.prototype.pop

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=188789

            Bug ID: 188789
           Summary: Fail to throw TypeError when set a getter-only
                    property in Array.prototype.pop
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sunlili at ict.ac.cn

Executing following code :
---------------------------------------------
function foo()
{
    var obj = {};

    Object.prototype.push = Array.prototype.push;
    Object.prototype.pop = Array.prototype.pop;
    var x;
    Object.defineProperty(obj, "length", {get: function() {x = true; return 5;}});
    //call set length while pop,but setter was undefined
    x = false;

    try
    {
        var len = obj.pop();
    }
    catch (e)
    {
        print('caught exception:');
        print(e);
    }
    print(x);
}
foo();

print("BT_FLAG");
-----------------------------------------------------

Output should be :
caught exception:
TypeError: setting getter-only property "length"
true
BT_FLAG

However, output of JavaScriptCore:
true
BT_FLAG



BT_GROUP
2018/8/21

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180821/eec9d6e6/attachment.html>