change behavior of Array.prototype.push?

Jann Horn jann at thejh.net
Sat Oct 29 22:06:36 UTC 2016


Hello!

At the moment, Array.prototype.push is (afaics) specified so that
it leaks property accesses to Array.prototype, as can be seen in V8/Chrome:

> Object.prototype.__defineSetter__('0', function(val){console.log('GOT '+val)}); [].push('FOO')
< GOT FOO
< 1

I think that's bad. Luckily, Firefox doesn't implement it in a
spec-compliant way:

> Object.prototype.__defineSetter__('0', function(val){console.log('GOT '+val)}); [].push('FOO')
< 1

... and nobody seems to have noticed, so changing the spec shouldn't
break things for anyone. So, would it be possible to specify Firefox'
behavior and deprecate the currently specified one?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20161030/7f848e16/attachment.sig>


More information about the es-discuss mailing list