{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/rhino/issues/209","labels_url":"https://api.github.com/repos/mozilla/rhino/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/rhino/issues/209/comments","events_url":"https://api.github.com/repos/mozilla/rhino/issues/209/events","html_url":"https://github.com/mozilla/rhino/pull/209","id":91614250,"number":209,"title":"Make array literal construction always set own properties of instance","user":{"login":"sainaen","id":2400185,"avatar_url":"https://avatars.githubusercontent.com/u/2400185?v=3","gravatar_id":"","url":"https://api.github.com/users/sainaen","html_url":"https://github.com/sainaen","followers_url":"https://api.github.com/users/sainaen/followers","following_url":"https://api.github.com/users/sainaen/following{/other_user}","gists_url":"https://api.github.com/users/sainaen/gists{/gist_id}","starred_url":"https://api.github.com/users/sainaen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sainaen/subscriptions","organizations_url":"https://api.github.com/users/sainaen/orgs","repos_url":"https://api.github.com/users/sainaen/repos","events_url":"https://api.github.com/users/sainaen/events{/privacy}","received_events_url":"https://api.github.com/users/sainaen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-28T16:33:33Z","updated_at":"2015-07-01T18:55:16Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/rhino/pulls/209","html_url":"https://github.com/mozilla/rhino/pull/209","diff_url":"https://github.com/mozilla/rhino/pull/209.diff","patch_url":"https://github.com/mozilla/rhino/pull/209.patch"},"body":"When new array created with array literal, previously we would create an array instance and call `ScriptableObject.putProperty()` for each defined element of array. That contradicts the spec that requires implementation to always set own property of newly created array instance, even when [[Set]], because of its recursive traversal nature, would update property on `Array.prototype`.\r\n\r\nConsider the case, when `Array.prototype` has \"0\" property defined, with `writable` property set to `false` in its descriptor:\r\n```js\r\n    Object.defineProperty(Array.prototype, \"0\", {\r\n        value: 10,\r\n        configurable: true,\r\n        enumerable: false,\r\n        writable: false\r\n    });\r\n```\r\nNow, all arrays that do not have \"0\" property defined, in [[Get]] would find a prototype property and return its value:\r\n\r\n```js\r\n    [][0]\r\n    //> 10\r\n```\r\n\r\nBut what's worse, when new array is created and it 1st element set to provided value, because `writable` property of its descriptor is `false`, `putProperty()` will not update the value:\r\n\r\n```js\r\n    [123][0]\r\n    //> 10\r\n```\r\n\r\nThis fix, ensures that when new array instance created from literal, only its own property will be set.\r\n\r\nAlso test262's [`Array/prototype/concat/15.4.4.4-5-b-iii-3-b-1.js`](https://github.com/tc39/test262/blob/master/test/built-ins/Array/prototype/concat/15.4.4.4-5-b-iii-3-b-1.js) now passes."},"comment":{"url":"https://api.github.com/repos/mozilla/rhino/issues/comments/117794972","html_url":"https://github.com/mozilla/rhino/pull/209#issuecomment-117794972","issue_url":"https://api.github.com/repos/mozilla/rhino/issues/209","id":117794972,"user":{"login":"sainaen","id":2400185,"avatar_url":"https://avatars.githubusercontent.com/u/2400185?v=3","gravatar_id":"","url":"https://api.github.com/users/sainaen","html_url":"https://github.com/sainaen","followers_url":"https://api.github.com/users/sainaen/followers","following_url":"https://api.github.com/users/sainaen/following{/other_user}","gists_url":"https://api.github.com/users/sainaen/gists{/gist_id}","starred_url":"https://api.github.com/users/sainaen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sainaen/subscriptions","organizations_url":"https://api.github.com/users/sainaen/orgs","repos_url":"https://api.github.com/users/sainaen/repos","events_url":"https://api.github.com/users/sainaen/events{/privacy}","received_events_url":"https://api.github.com/users/sainaen/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T18:55:16Z","updated_at":"2015-07-01T18:55:16Z","body":"Added.\r\n\r\nI'm working on unignoring and adding the rest of Array tests in separate PR. In particular, I think I have a fix for handling array-like objects with lengths bigger than 2^32 passed to Array's method (according to ES6, methods that don't create arrays should handle those cases)."}}