Array.prototype.pop should throw if property is not configurable

https://bugs.webkit.org/show_bug.cgi?id=75788

Rubber Stamped by Oliver Hunt.

No real bug here any more, but the error we throw sometimes has a misleading message.

* runtime/JSArray.cpp:
(JSC::JSArray::pop):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121700 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 963b10a..26f9f3f 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2012-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.pop should throw if property is not configurable
+        https://bugs.webkit.org/show_bug.cgi?id=75788
+
+        Rubber Stamped by Oliver Hunt.
+
+        No real bug here any more, but the error we throw sometimes has a misleading message.
+ 
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+
 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
 
         JSObject wastes too much memory on unused property slots

diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 96cc447..7218604 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -1258,7 +1258,10 @@ JSValue JSArray::pop(ExecState* exec)
     if (exec->hadException())
         return jsUndefined();
     // Call the [[Delete]] internal method of O with arguments indx and true.
-    deletePropertyByIndex(this, exec, index);
+    if (!deletePropertyByIndex(this, exec, index)) {
+        throwTypeError(exec, "Unable to delete property.");
+        return jsUndefined();
+    }
     // Call the [[Put]] internal method of O with arguments "length", indx, and true.
     setLength(exec, index, true);
     // Return element.