Bug 186992

Summary: Different output compared with other JS engines
Product: WebKit Reporter: sunlili
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ashvayka, sunlili, ysuzuki
Priority: P2    
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=186991
https://bugs.webkit.org/show_bug.cgi?id=186993

Description sunlili 2018-06-24 23:54:32 PDT
Hello,
The following code behaves incorrectly (inconsistent with the standard and other engines).

arr0 = [ 1, 2, 3 ];
arr1 = [ 4, 5, 6 ]; 
handler1 = { 
    get: function (oTarget, sKey) { 
       print('arg ' + '1' + ':get ' + sKey.toString()); 
       if (sKey.toString() == 'Symbol(Symbol.isConcatSpreadable)') {
        return true; } 
       if (sKey.toString() == 'length') { 
        arr1[0] = { 0: 'a', true: 'b', 2: 'c' }; 
       } 
       if (Number(sKey.toString()) != NaN) { 
        arr0[1] = [ 1, 2, 3 ]; 
        arr0[2] = {}; return false; 
       }
       return Reflect.get(oTarget, sKey); 
    }, 
    has: function (oTarget, sKey) { 
       print('arg ' + '1' + ':has ' + sKey.toString()); 
       if (Number(sKey.toString()) != NaN) {
          return [ 1, 2, 3 ]; } 
       return Reflect.has(oTarget, sKey);
    } 
}; 
var proxy1 = new Proxy(arr1, handler1); 
arr2 = Array.prototype.concat.call(arr0, proxy1); 
print(arr2);

Output is:
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get length
1,2,3

However, it should be:
arg 1:get Symbol(Symbol.isConcatSpreadable)
arg 1:get length
1,2,3
Comment 1 Alexey Shvayka 2020-05-07 15:40:13 PDT
(In reply to sunlili from comment #0)
> However, it should be:
> arg 1:get Symbol(Symbol.isConcatSpreadable)
> arg 1:get length
> 1,2,3

As of r232261, JSC outputs as expected.

*** This bug has been marked as a duplicate of bug 184267 ***