Status: Accepted
Owner: [email protected]
Labels: Type-Bug Priority-Medium
New issue 3309 by [email protected]: out of bounds array elements can
be set when length is read-only
http://code.google.com/p/v8/issues/detail?id=3309
Simple repro from [email protected]:
var a = [];
Object.defineProperty(a, "length", {value:0, configurable: false, writable:
false});
a[0] = 1;
print(a.length);
print(a[0]);
According to spec, we should reject setting the array element (by section
15.4.5.1, the array implementation of DefineOwnProperty step 4b).
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
