v8/test/mjsunit/regress/regress-v8-9460.js
Adam Klein 40624b5b41 [runtime] Always throw when asked to make an array's length configurable
Previously, if the new length was less than the current length, we ignored
the "configurable" value and set the length as requested. We already threw
if the new length was greater than or equal to the current length.

New behavior matches the spec and other implementations.

Bug: v8:9460
Change-Id: Idb92fd121bdaa707f6abd2d2082628bbf3541b83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709336
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62855}
2019-07-22 17:16:10 +00:00

21 lines
594 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var arr = [0, 1];
assertThrows(
() => Object.defineProperty(arr, 'length', {value: 1, configurable: true}),
TypeError);
assertEquals(2, arr.length);
assertThrows(
() => Object.defineProperty(arr, 'length', {value: 2, configurable: true}),
TypeError);
assertEquals(2, arr.length);
assertThrows(
() => Object.defineProperty(arr, 'length', {value: 3, configurable: true}),
TypeError);
assertEquals(2, arr.length);