Fix Array.prototype.concat() when 'this' is not an array.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai.u-szeged@partner.samsung.com

Author: dbatyai

jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp

@@ -113,24 +113,47 @@ ecma_builtin_array_prototype_object_concat (ecma_value_t this_arg, /**< this arg
   ecma_completion_value_t new_array = ecma_op_create_array_object (0, 0, false);
   ecma_object_t *new_array_p = ecma_get_object_from_completion_value (new_array);
 
+  /* 5.b */
+  if (ecma_object_get_class_name (obj_p) == LIT_MAGIC_STRING_ARRAY_UL)
+  {
+    /* 5.b.iii */
+    for (uint32_t index = 0;
+         index < len && ecma_is_completion_value_empty (ret_value);
+         index++, new_array_index++)
+    {
+      ecma_string_t *index_string_p = ecma_new_ecma_string_from_uint32 (index);
+      /* 5.b.iii.3.a */
+      ECMA_TRY_CATCH (get_value, ecma_op_object_get (obj_p, index_string_p), ret_value);
 
-  for (uint32_t index = 0;
-       index < len && ecma_is_completion_value_empty (ret_value);
-       index++, new_array_index++)
+      /* Using [[Put]] is equvalent to [[DefineOwnProperty]] in this case, so we use it for simplicity. */
+      ecma_completion_value_t put_comp = ecma_op_object_put (new_array_p,
+                                                             index_string_p,
+                                                             get_value,
+                                                             false);
+      JERRY_ASSERT (ecma_is_completion_value_normal (put_comp));
+      ecma_free_completion_value (put_comp);
+
+      ECMA_FINALIZE (get_value);
+      ecma_deref_ecma_string (index_string_p);
+    }
+  }
+  /* 5.c */
+  else
   {
-    ecma_string_t *index_string_p = ecma_new_ecma_string_from_uint32 (index);
-    ECMA_TRY_CATCH (get_value, ecma_op_object_get (obj_p, index_string_p), ret_value);
+    ecma_string_t *new_array_index_string_p = ecma_new_ecma_string_from_uint32 (new_array_index);
 
-    /* Using [[Put]] is equvalent to [[DefineOwnProperty]] in this case, so we use it for simplicity. */
+    /* 5.c.i */
     ecma_completion_value_t put_comp = ecma_op_object_put (new_array_p,
-                                                           index_string_p,
-                                                           get_value,
+                                                           new_array_index_string_p,
+                                                           this_arg,
                                                            false);
-    JERRY_ASSERT (ecma_is_completion_value_normal (put_comp));
+    JERRY_ASSERT (ecma_is_completion_value_normal_true (put_comp));
     ecma_free_completion_value (put_comp);
 
-    ECMA_FINALIZE (get_value);
-    ecma_deref_ecma_string (index_string_p);
+    ecma_deref_ecma_string (new_array_index_string_p);
+
+    /* 5.c.ii */
+    new_array_index++;
   }
 
   for (uint32_t arg_index = 0;

tests/jerry/array-prototype-concat.js

@@ -21,10 +21,17 @@ for (i = 0; i < array.length; i++) {
 	assert(array[i] === new_arr[i]);
 }
 
-var obj = {};
+var obj = { concat : Array.prototype.concat };
 var arr1 = ["Apple", 6, "Peach"];
 var arr2 = [obj, "Cherry", "Grape"];
 
+var new_array = obj.concat(arr1);
+assert(new_array.length === 4);
+assert(new_array[0] === obj);
+assert(new_array[1] === "Apple");
+assert(new_array[2] === 6);
+assert(new_array[3] === "Peach");
+
 var new_array = arr1.concat(arr2, obj, 1);
 
 assert(new_array.length === 8);
@@ -50,24 +57,13 @@ for (i = 0; i < result.length; i++) {
 	assert(result[i] === expected[i]);
 }
 
-// Checking behavior when unable to get length
-var obj = { concat : Array.prototype.concat }
-Object.defineProperty(obj, 'length', { 'get' : function () {throw new ReferenceError ("foo"); } });
-
-try {
-	obj.concat();
-	assert(false);
-} catch (e) {
-	assert(e.message === "foo");
-	assert(e instanceof ReferenceError);
-}
-
 // Checking behavior when unable to get element
-var obj = { concat : Array.prototype.concat, length : 1 }
-Object.defineProperty(obj, '0', { 'get' : function () {throw new ReferenceError ("foo"); } });
+var arr = []
+Object.defineProperty(arr, '0', { 'get' : function () {throw new ReferenceError ("foo"); } });
+arr.length = 1;
 
 try {
-	obj.concat();
+	arr.concat();
 	assert(false);
 } catch (e) {
 	assert(e.message === "foo");