[Webkit-unassigned] [Bug 208708] New: @putByValDirect does not perform [[DefineOwnProperty]] correctly

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=208708

            Bug ID: 208708
           Summary: @putByValDirect does not perform [[DefineOwnProperty]]
                    correctly
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Minor
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: shvaikalesh at gmail.com

CreateDataPropertyOrThrow (https://tc39.es/ecma262/#sec-createdatapropertyorthrow), called on property with descriptor:

1. {writable: false, configurable: true}
Expected: results in {value, writable: true, enumerable: true, configurable: true}
Actual: TypeError is thrown (seems like [[Set]] is performed instead)
ECMA262: https://tc39.es/ecma262/#sec-validateandapplypropertydescriptor (step 9.a)
Test262: https://test262.report/browse/built-ins/Array/of/does-not-use-set-for-indices.js

2. {writable: true, configurable: false} or {set: function() {}, configurable: false}
Expected: should throw TypeError
Actual: results in {value, writable: true, enumerable: true, configurable: true} (seems like descriptor validation is skipped)
ECMA262: https://tc39.es/ecma262/#sec-validateandapplypropertydescriptor (step 4.a)
Test262:
  https://test262.report/browse/built-ins/Array/prototype/filter/target-array-with-non-configurable-property.js
  https://test262.report/browse/built-ins/Array/prototype/map/target-array-with-non-configurable-property.js

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200306/3ee7c638/attachment-0001.htm>