Closed Bug 1317307 Opened 3 years ago Closed 3 years ago

Throw TypeError when attempting to redefine array.length to accessor property

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla53
Tracking Status
firefox52 --- wontfix
firefox53 --- fixed

People

(Reporter: anba, Assigned: anba)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Test case:
---
Object.defineProperty([], "length", {get(){}})
---

Expected: Throws TypeError
Actual: Throws RangeError
Attached patch bug1317307.patchSplinter Review
The change in js::ArraySetLength is just a drive-by fix, I think the assertion should belong to the other block.
Attachment #8810529 - Flags: review?(till)
Comment on attachment 8810529 [details] [diff] [review]
bug1317307.patch

Review of attachment 8810529 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, thanks
Attachment #8810529 - Flags: review?(till) → review+
Keywords: checkin-needed
Pushed by cbook@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/55b6cacff791
Throw a TypeError when attempting to change array.length to accessor property. r=till
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/55b6cacff791
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
We should probably look into backporting this.
Flags: needinfo?(andrebargull)
This is also a simple bug fix, but only important for test262 and not user code, because
1. We're just fixing the error type (from RangeError to TypeError)
2. and users don't try to change an array's length property to an accessor, because it doesn't make sense to begin with.
Flags: needinfo?(andrebargull)
You need to log in before you can comment on or make changes to this bug.