change behavior of Array.prototype.push?

Jordan Harband ljharb at gmail.com
Sat Oct 29 22:15:48 UTC 2016


That just means anyone relying on that behavior is broken in Firefox - if
their code would work in all of the other browsers, then it's a Firefox
bug, not something the spec can change.

Note that you can also observe this behavior with:
`Array.prototype.push.call(Object.defineProperty({}, '0', { set: function
(v) { throw v; } }), 1)` which *does* correctly throw for me in Firefox,
Safari, and Chrome.

Similarly, I do see that `Object.defineProperty(Object.prototype, '0', {
set: function (v) { throw v; } }); [].push(1)` and
`Object.defineProperty(Array.prototype, '0', { set: function (v) { throw v;
} }); [].push(1)` also fail to throw in Firefox, but do correctly throw in
Safari and Chrome.

In other words, changing the spec here would make code that depends on the
lookup on the *receiver* fail, including the code above - Firefox's bug is
solely that it doesn't work when the receiver inherits from
`Object.prototype` or `Array.prototype`, and `Object.prototype` or
`Array.prototype` has been modified.

Please do file this Firefox bug ASAP, so they can correct it.

On Sat, Oct 29, 2016 at 3:06 PM, Jann Horn <jann at thejh.net> wrote:

> Hello!
>
> At the moment, Array.prototype.push is (afaics) specified so that
> it leaks property accesses to Array.prototype, as can be seen in V8/Chrome:
>
> > Object.prototype.__defineSetter__('0', function(val){console.log('GOT
> '+val)}); [].push('FOO')
> < GOT FOO
> < 1
>
> I think that's bad. Luckily, Firefox doesn't implement it in a
> spec-compliant way:
>
> > Object.prototype.__defineSetter__('0', function(val){console.log('GOT
> '+val)}); [].push('FOO')
> < 1
>
> ... and nobody seems to have noticed, so changing the spec shouldn't
> break things for anyone. So, would it be possible to specify Firefox'
> behavior and deprecate the currently specified one?
>
> _______________________________________________
> es-discuss mailing list
> es-discuss at mozilla.org
> https://mail.mozilla.org/listinfo/es-discuss
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20161029/1fc48453/attachment.html>


More information about the es-discuss mailing list