[Webkit-unassigned] [Bug 186992] New: Different output compared with other JS engines

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=186992

            Bug ID: 186992
           Summary: Different output compared with other JS engines
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sunlili at ict.ac.cn

Hello,
The following code behaves incorrectly (inconsistent with the standard and other engines).

arr0 = [ 1, 2, 3 ];
arr1 = [ 4, 5, 6 ]; 
handler1 = { 
    get: function (oTarget, sKey) { 
       print('arg ' + '1' + ':get ' + sKey.toString()); 
       if (sKey.toString() == 'Symbol(Symbol.isConcatSpreadable)') {
        return true; } 
       if (sKey.toString() == 'length') { 
        arr1[0] = { 0: 'a', true: 'b', 2: 'c' }; 
       } 
       if (Number(sKey.toString()) != NaN) { 
        arr0[1] = [ 1, 2, 3 ]; 
        arr0[2] = {}; return false; 
       }
       return Reflect.get(oTarget, sKey); 
    }, 
    has: function (oTarget, sKey) { 
       print('arg ' + '1' + ':has ' + sKey.toString()); 
       if (Number(sKey.toString()) != NaN) {
          return [ 1, 2, 3 ]; } 
       return Reflect.has(oTarget, sKey);
    } 
}; 
var proxy1 = new Proxy(arr1, handler1); 
arr2 = Array.prototype.concat.call(arr0, proxy1); 
print(arr2);

Output is:
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get length
1,2,3

However, it should be:
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get length
1,2,3

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180625/57dd3162/attachment.html>