Bug 188789

Executing following code :
---------------------------------------------
function foo()
{
    var obj = {};

    Object.prototype.push = Array.prototype.push;
    Object.prototype.pop = Array.prototype.pop;
    var x;
    Object.defineProperty(obj, "length", {get: function() {x = true; return 5;}});
    //call set length while pop,but setter was undefined
    x = false;

    try
    {
        var len = obj.pop();
    }
    catch (e)
    {
        print('caught exception:');
        print(e);
    }
    print(x);
}
foo();

print("BT_FLAG");
-----------------------------------------------------

Output should be :
caught exception:
TypeError: setting getter-only property "length"
true
BT_FLAG

However, output of JavaScriptCore:
true
BT_FLAG



BT_GROUP
2018/8/21