590690 - Assigning to an array's length cheerfully deletes non-configurable properties

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

Arrays can have non-configurable elements:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> delete a[2]
false
js> a
[1, 2, 3]

However, Array.prototype.pop can delete them just the same:

js> a.pop()
3
js> a
[1, 2]

Comment 1

[Jim Blandy :jimb]

The patch for bug 514574 fixes the behavior described above, since it implements the ES5 requirement that all Array.prototype members behave as if they were strict:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> a.pop()
typein:3: TypeError: property 'a.pop()' is non-configurable and cannot be deleted
js> 

The underlying problem is that assigning to the length of an array will silently delete non-configurable properties:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> a.length = 2
2
js> a
[1, 2]

Comment 2

[Jim Blandy :jimb]

The patch for bug 537873 now fixes this bug as well.

Comment 3

[Jim Blandy :jimb]

(The easier implementation takes advantage of DeleteArrayElement's strict mode code behavior, so it is simplest to fold this change in with that, rather than fixing it with an independent patch.)

Comment 4

[Brendan Eich [:brendan]]

Is this fixed now?

/be

Comment 5

[Jim Blandy :jimb]

Halfway --- the element is not deleted, but it doesn't throw an error if the assignment is in strict mode code. I'm about to post patches for bug 537873, which will address that; when that lands, we can close this.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Bug 537873 landed, can we close this?

Comment 7

[Jeff Walden [:Waldo]]

Yes, this looks fixed to me, based on typing the testcases here into a web console.

js> "use strict"; a.length = 2
TypeError: property 2 is non-configurable and can't be deleted