[Webkit-unassigned] [Bug 200337] New: Can Array.prototype.push.apply() function pass argument of String type?

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Aug 1 00:35:03 PDT 2019


https://bugs.webkit.org/show_bug.cgi?id=200337

            Bug ID: 200337
           Summary: Can Array.prototype.push.apply() function pass
                    argument of String type?
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: yaohouyou at stumail.nwu.edu.cn

#Testcase:
1 var foo = function(array) {
2     var a = [0,1,2];
3     Array.prototype.push.apply(array, a);
4     print(array.length);
5     print(array);
6 };
7 var str = “asdadc”;
8 foo(str);

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
6
asdadc

#Expected output:
testcase.js:3: TypeError: Cannot assign to read only property 'length' of object '[object String]'

#Description:
According to the ECMAScript-262 standard, a TypeError exception should be thrown when executing the above testcase. However, javascriptCore doesn’t throw any exception but outputs “6” and “asdadc” while other JS engines such as V8, SpiderMonkey throw an exception. According to the ES standard, an exception should be thrown when executing the Set(O, "length", len, true) method, because the string’s length is read-only. So I suspect that it’s a bug of JavaScriptCore.
The references of ECMAScript-262 standard are as follows: 
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push
http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190801/e11cc338/attachment.html>


More information about the webkit-unassigned mailing list