From 2b4b0125ef78391eebfd342b7f8d14efe7027bbf Mon Sep 17 00:00:00 2001 From: liujia178 Date: Tue, 16 Apr 2024 21:12:44 +1030 Subject: [PATCH] When writable is false, throwing TypeError does not change the original data --- ecmascript/builtins/builtins_array.cpp | 8 ++++---- test/regresstest/regresstest_skip_tests.json | 1 - 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/ecmascript/builtins/builtins_array.cpp b/ecmascript/builtins/builtins_array.cpp index adbaf5b79..223ef507e 100644 --- a/ecmascript/builtins/builtins_array.cpp +++ b/ecmascript/builtins/builtins_array.cpp @@ -1605,14 +1605,14 @@ JSTaggedValue BuiltinsArray::Push(EcmaRuntimeCallInfo *argv) JSThread *thread = argv->GetThread(); [[maybe_unused]] EcmaHandleScope handleScope(thread); JSHandle thisHandle = GetThis(argv); - if (thisHandle->IsStableJSArray(thread)) { + // 1. Let O be ToObject(this value). + JSHandle thisObjHandle = JSTaggedValue::ToObject(thread, thisHandle); + if (thisHandle->IsStableJSArray(thread) && JSObject::IsArrayLengthWritable(thread, thisObjHandle)) { return JSStableArray::Push(JSHandle::Cast(thisHandle), argv); } // 6. Let argCount be the number of elements in items. uint32_t argc = argv->GetArgsNumber(); - // 1. Let O be ToObject(this value). - JSHandle thisObjHandle = JSTaggedValue::ToObject(thread, thisHandle); // 2. ReturnIfAbrupt(O). RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread); JSHandle thisObjVal(thisObjHandle); @@ -2381,7 +2381,7 @@ JSTaggedValue BuiltinsArray::Splice(EcmaRuntimeCallInfo *argv) JSTaggedNumber(static_cast(actualDeleteCount))); RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread); JSHandle newArrayHandle(thread, newArray); - if (thisHandle->IsStableJSArray(thread)) { + if (thisHandle->IsStableJSArray(thread) && JSObject::IsArrayLengthWritable(thread, thisObjHandle)) { return JSStableArray::Splice(JSHandle::Cast(thisHandle), argv, start, insertCount, actualDeleteCount, newArrayHandle, len); } diff --git a/test/regresstest/regresstest_skip_tests.json b/test/regresstest/regresstest_skip_tests.json index 0983e1afc..0e91e1dfd 100644 --- a/test/regresstest/regresstest_skip_tests.json +++ b/test/regresstest/regresstest_skip_tests.json @@ -1764,7 +1764,6 @@ "mjsunit/body-not-visible.js", "mjsunit/try-catch-extension-object.js", "mjsunit/regexp-standalones.js", - "mjsunit/array-methods-read-only-length.js", "mjsunit/newline-in-string.js", "mjsunit/clone-ic-regressions.js", "mjsunit/tzoffset-seoul-noi18n.js", -- Gitee