diff --git a/ecmascript/builtins/builtins_array.cpp b/ecmascript/builtins/builtins_array.cpp index adbaf5b7971701d89a512a9a4996756d1be8d208..223ef507e825c7336d51f4d64e723060f41fe7c4 100644 --- a/ecmascript/builtins/builtins_array.cpp +++ b/ecmascript/builtins/builtins_array.cpp @@ -1605,14 +1605,14 @@ JSTaggedValue BuiltinsArray::Push(EcmaRuntimeCallInfo *argv) JSThread *thread = argv->GetThread(); [[maybe_unused]] EcmaHandleScope handleScope(thread); JSHandle thisHandle = GetThis(argv); - if (thisHandle->IsStableJSArray(thread)) { + // 1. Let O be ToObject(this value). + JSHandle thisObjHandle = JSTaggedValue::ToObject(thread, thisHandle); + if (thisHandle->IsStableJSArray(thread) && JSObject::IsArrayLengthWritable(thread, thisObjHandle)) { return JSStableArray::Push(JSHandle::Cast(thisHandle), argv); } // 6. Let argCount be the number of elements in items. uint32_t argc = argv->GetArgsNumber(); - // 1. Let O be ToObject(this value). - JSHandle thisObjHandle = JSTaggedValue::ToObject(thread, thisHandle); // 2. ReturnIfAbrupt(O). RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread); JSHandle thisObjVal(thisObjHandle); @@ -2381,7 +2381,7 @@ JSTaggedValue BuiltinsArray::Splice(EcmaRuntimeCallInfo *argv) JSTaggedNumber(static_cast(actualDeleteCount))); RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread); JSHandle newArrayHandle(thread, newArray); - if (thisHandle->IsStableJSArray(thread)) { + if (thisHandle->IsStableJSArray(thread) && JSObject::IsArrayLengthWritable(thread, thisObjHandle)) { return JSStableArray::Splice(JSHandle::Cast(thisHandle), argv, start, insertCount, actualDeleteCount, newArrayHandle, len); } diff --git a/test/regresstest/regresstest_skip_tests.json b/test/regresstest/regresstest_skip_tests.json index 0983e1afc517f52415096b1b18446ee21dc11fbd..0e91e1dfdbc468b3765409171691915bf32c6440 100644 --- a/test/regresstest/regresstest_skip_tests.json +++ b/test/regresstest/regresstest_skip_tests.json @@ -1764,7 +1764,6 @@ "mjsunit/body-not-visible.js", "mjsunit/try-catch-extension-object.js", "mjsunit/regexp-standalones.js", - "mjsunit/array-methods-read-only-length.js", "mjsunit/newline-in-string.js", "mjsunit/clone-ic-regressions.js", "mjsunit/tzoffset-seoul-noi18n.js",