JDK-8035312 : push() on frozen array increases its length property
  • Type: Bug
  • Component: core-libs
  • Sub-Component: jdk.nashorn
  • Affected Version: 8u40
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2014-02-19
  • Updated: 2015-06-04
  • Resolved: 2014-11-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u40Fixed 9 b40Fixed
Description
x = [1, 2, 3]; Object.freeze(x); x.push(4);
<shell>:1 TypeError: Cannot set property "3" of frozen array
jjs> x
1,2,3,0
jjs> x.length
4

x.length should still be 3.
Comments
Turns out to be quite a bit bigger than expected. This involves length on various ScriptObject and array operations implicit and explicit. Writing an exhaustive unit test as part of the fix
10-11-2014
Taking over this to balance bug load.
28-10-2014
related issue: var arr = []; Object.defineProperty(arr, "length", { writable: false }); try { arr.push("foo"); } catch(e) { } print(arr.length); print(arr[0]); Expected output: 0 foo Actual output: 1 foo "length" should not be modified because it is non-writable. But element should be pushed because "push" first pushes elements and the sets the "length" at the end per spec. http://es5.github.io/#x15.4.4.7
24-09-2014