Closed Bug 590690 Opened 11 years ago Closed 9 years ago

Assigning to an array's length cheerfully deletes non-configurable properties

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jimb, Unassigned)

References

Details

Arrays can have non-configurable elements:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> delete a[2]
false
js> a
[1, 2, 3]

However, Array.prototype.pop can delete them just the same:

js> a.pop()
3
js> a
[1, 2]
Group: core-security
The patch for bug 514574 fixes the behavior described above, since it implements the ES5 requirement that all Array.prototype members behave as if they were strict:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> a.pop()
typein:3: TypeError: property 'a.pop()' is non-configurable and cannot be deleted
js> 

The underlying problem is that assigning to the length of an array will silently delete non-configurable properties:

js> var a=[1,2,3]
js> Object.defineProperty(a,2,{configurable:false})
[1, 2, 3]
js> a.length = 2
2
js> a
[1, 2]
Summary: Array.pop can delete non-configurable properties → Assigning to an array's length cheerfully deletes non-configurable properties
The patch for bug 537873 now fixes this bug as well.
Depends on: 537873
(The easier implementation takes advantage of DeleteArrayElement's strict mode code behavior, so it is simplest to fold this change in with that, rather than fixing it with an independent patch.)
No longer depends on: 537873
Depends on: 537873
Is this fixed now?

/be
Blocks: es5
Halfway --- the element is not deleted, but it doesn't throw an error if the assignment is in strict mode code. I'm about to post patches for bug 537873, which will address that; when that lands, we can close this.
Yes, this looks fixed to me, based on typing the testcases here into a web console.

js> "use strict"; a.length = 2
TypeError: property 2 is non-configurable and can't be deleted
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.