<html>
    <head>
      <base href="https://bugs.webkit.org/">
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Can Array.prototype.push.apply() function pass argument of String type?"
   href="https://bugs.webkit.org/show_bug.cgi?id=200337">200337</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Can Array.prototype.push.apply() function pass argument of String type?
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>WebKit
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>WebKit Local Build
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P2
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>JavaScriptCore
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>webkit-unassigned@lists.webkit.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>yaohouyou@stumail.nwu.edu.cn
          </td>
        </tr></table>
      <p>
        <div>
        <pre>#Testcase:
1 var foo = function(array) {
2     var a = [0,1,2];
3     Array.prototype.push.apply(array, a);
4     print(array.length);
5     print(array);
6 };
7 var str = “asdadc”;
8 foo(str);

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
6
asdadc

#Expected output:
testcase.js:3: TypeError: Cannot assign to read only property 'length' of object '[object String]'

#Description:
According to the ECMAScript-262 standard, a TypeError exception should be thrown when executing the above testcase. However, javascriptCore doesn’t throw any exception but outputs “6” and “asdadc” while other JS engines such as V8, SpiderMonkey throw an exception. According to the ES standard, an exception should be thrown when executing the Set(O, "length", len, true) method, because the string’s length is read-only. So I suspect that it’s a bug of JavaScriptCore.
The references of ECMAScript-262 standard are as follows: 
<a href="http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push">http://www.ecma-international.org/ecma-262/6.0/index.html#sec-array.prototype.push</a>
<a href="http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7">http://www.ecma-international.org/ecma-262/5.1/index.html#sec-15.4.4.7</a></pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>