e365bc2dcb
This CL fixes a bug that allowed calls to Array.p.shift on zero-length arrays where the 'length' is read-only without throwing a TypeError. R=bmeurer@chromium.org, jgruber@chromium.org Bug: chromium:882233 Change-Id: Ib129ab4c4f4f233e7bb553effa77539badfbe26e Reviewed-on: https://chromium-review.googlesource.com/1215164 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Simon Zünd <szuend@google.com> Cr-Commit-Position: refs/heads/master@{#55746}
18 lines
551 B
JavaScript
18 lines
551 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Intended to test bug [882233] on CSA fast-path.
|
|
|
|
let array = [];
|
|
Object.defineProperty(array, 'length', {writable: false});
|
|
|
|
assertEquals(array.length, 0);
|
|
assertThrows(() => array.shift(), TypeError);
|
|
|
|
let object = { length: 0 };
|
|
Object.defineProperty(object, 'length', {writable: false});
|
|
|
|
assertEquals(object.length, 0);
|
|
assertThrows(() => Array.prototype.shift.call(object));
|