[Webkit-unassigned] [Bug 201910] New: Array.prototype.push() neither takes effect nor throws an exception

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=201910

            Bug ID: 201910
           Summary: Array.prototype.push() neither takes effect nor throws
                    an exception
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: nwu_ty at 163.com

Created attachment 379026

  --> https://bugs.webkit.org/attachment.cgi?id=379026&action=review

testcase

#Testcase:
1  var array = [ 0, 1, 2 ];
2  var str = "asdadc";
3  Array.prototype.push.apply(str, array);
4  print(str.length);
5  print(str);

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
6
asdadc

#Expected output:
Throw a TypeError in line3.

#Description:
When executing the above testcase, a TypeError should be thrown according to ECMAScript-262 standard. However, javascriptCore doesn't throw any exception but outputs "6" and "asdadc" while other JS engines such as V8, SpiderMonkey throw a TypeError. 

According to the output, I guess that JavaScriptCore neither executed Array.prototype.push() function normally nor thrown a TypeError. So I suspect that it's a bug of JavaScriptCore.

References: 
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push
http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190918/f69977b3/attachment.html>