1317307 - Throw TypeError when attempting to redefine array.length to accessor property

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

Test case:
---
Object.defineProperty([], "length", {get(){}})
---

Expected: Throws TypeError
Actual: Throws RangeError

Comment 1

[André Bargull [:anba]]

Attachment: bug1317307.patch

The change in js::ArraySetLength is just a drive-by fix, I think the assertion should belong to the other block.

Comment 2

[Till Schneidereit [:till]]

Comment on attachment 8810529 [details] [diff] [review]
bug1317307.patch

Review of attachment 8810529 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, thanks

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/55b6cacff791
Throw a TypeError when attempting to change array.length to accessor property. r=till

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/55b6cacff791

Comment 5

[Hannes Verschore [:h4writer]]

We should probably look into backporting this.

Comment 6

[André Bargull [:anba]]

This is also a simple bug fix, but only important for test262 and not user code, because
1. We're just fixing the error type (from RangeError to TypeError)
2. and users don't try to change an array's length property to an accessor, because it doesn't make sense to begin with.