Fixed Array.prototype.reverse() behavior when array is frozen or array elements are not writable an…

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 468 matching lines @@
   var arrays = new InternalArray(1 + arg_count);
   arrays[0] = array;
   for (var i = 0; i < arg_count; i++) {
     arrays[i + 1] = %_Arguments(i);
   }
 
   return %ArrayConcat(arrays);
 }
 
 
+// Check if property is writable
+// return true if there is no property descriptor
+function PropertyIsWritable(o, p) {
+  var d = ObjectGetOwnPropertyDescriptor(o, p);
+  return !d || d.writable === true;
+}
+
+
+// Check if property is configurable
+// return true if there is no property descriptor
+function PropertyIsConfigurable(o, p) {
+  var d = ObjectGetOwnPropertyDescriptor(o, p);
+  return !d || d.configurable === true;
+}
+
+
+// Prepare and return TypeError object for array method
+function MakeTypeErrorForReadOnly(method_name) {
+  return MakeTypeError("called_on_read_only",
+                      ["Array.prototype." + method_name]);
+}
+
+
+function MakeTypeErrorForNonConfigurableProperty(method_name) {
+  return MakeTypeError("cant_delete_non_configurable_property",
+                      ["Array.prototype." + method_name]);
+}
+
+
+function ThrowTypeErrorIfNotWritable(method_name, a, p) {
+  if (!PropertyIsWritable(a, p)) {
+    throw MakeTypeErrorForReadOnly(method_name);
+  }
+}
+
+
+function ThrowTypeErrorIfNotConfigurable(method_name, a, p) {
+  if (!PropertyIsConfigurable(a, p)) {
+    throw MakeTypeErrorForNonConfigurableProperty(method_name);
+  }
+}
+
+
 // For implementing reverse() on large, sparse arrays.
 function SparseReverse(array, len) {
   var keys = GetSortedArrayKeys(array, %GetArrayKeys(array, len));
   var high_counter = keys.length - 1;
   var low_counter = 0;
+  var method_name = "reverse";
+  
   while (low_counter <= high_counter) {
     var i = keys[low_counter];
     var j = keys[high_counter];
 
     var j_complement = len - j - 1;
     var low, high;
 
     if (j_complement <= i) {
       high = j;
       while (keys[--high_counter] == j) { }
       low = j_complement;
     }
     if (j_complement >= i) {
       low = i;
       while (keys[++low_counter] == i) { }
       high = len - i - 1;
     }
 
     var current_i = array[low];
     if (!IS_UNDEFINED(current_i) || low in array) {
       var current_j = array[high];
       if (!IS_UNDEFINED(current_j) || high in array) {
+        ThrowTypeErrorIfNotWritable(method_name, array, low);
         array[low] = current_j;
+        
+        ThrowTypeErrorIfNotWritable(method_name, array, high);
         array[high] = current_i;
       } else {
+        ThrowTypeErrorIfNotWritable(method_name, array, high);
         array[high] = current_i;
+        
+        ThrowTypeErrorIfNotConfigurable(method_name, array, low);
         delete array[low];
       }
     } else {
       var current_j = array[high];
       if (!IS_UNDEFINED(current_j) || high in array) {
+        ThrowTypeErrorIfNotWritable(method_name, array, low);
         array[low] = current_j;
+        
+        ThrowTypeErrorIfNotConfigurable(method_name, array, high);
         delete array[high];
       }
     }
   }
 }
 
 
 function ArrayReverse() {
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["Array.prototype.reverse"]);
   }
-
+  
+  var method_name = "reverse";
+  
+  if (ObjectIsFrozen(this)) {
+    throw MakeTypeErrorForReadOnly(method_name);
+  }
+  
   var j = TO_UINT32(this.length) - 1;
 
   if (UseSparseVariant(this, j, IS_ARRAY(this))) {
     SparseReverse(this, j+1);
     return this;
   }
-
+  
   for (var i = 0; i < j; i++, j--) {
     var current_i = this[i];
     if (!IS_UNDEFINED(current_i) || i in this) {
       var current_j = this[j];
       if (!IS_UNDEFINED(current_j) || j in this) {
+        ThrowTypeErrorIfNotWritable(method_name, this, i);
         this[i] = current_j;
+        
+        ThrowTypeErrorIfNotWritable(method_name, this, j);
         this[j] = current_i;
       } else {
+        ThrowTypeErrorIfNotWritable(method_name, this, j);
         this[j] = current_i;
+        
+        ThrowTypeErrorIfNotConfigurable(method_name, this, i);
         delete this[i];
       }
     } else {
       var current_j = this[j];
       if (!IS_UNDEFINED(current_j) || j in this) {
+        ThrowTypeErrorIfNotWritable(method_name, this, i);
         this[i] = current_j;
+        
+        ThrowTypeErrorIfNotConfigurable(method_name, this, j);
         delete this[j];
       }
     }
   }
   return this;
 }
 
 
 function ArrayShift() {
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
@@ skipping 953 matching lines @@
   // exposed to user code.
   // Adding only the functions that are actually used.
   SetUpLockedPrototype(InternalArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();