diff --git a/core/engine/src/builtins/array/mod.rs b/core/engine/src/builtins/array/mod.rs index acd695878ea..ff79728832f 100644 --- a/core/engine/src/builtins/array/mod.rs +++ b/core/engine/src/builtins/array/mod.rs @@ -1291,6 +1291,7 @@ impl Array { .with_message("length + number of arguments exceeds the max safe integer limit") .into()); } + // b. Let k be len. let mut k = len; // c. Repeat, while k > 0, diff --git a/core/engine/src/builtins/array/tests.rs b/core/engine/src/builtins/array/tests.rs index 7f8d2d98f72..12255e848e0 100644 --- a/core/engine/src/builtins/array/tests.rs +++ b/core/engine/src/builtins/array/tests.rs @@ -249,6 +249,24 @@ fn unshift() { TestAction::assert_eq("arr.unshift(1, 2)", 4), TestAction::assert("arrayEquals(arr, [1, 2, 3, 4])"), ]); + + // Test case from PR 5076 ensuring unshift doesn't bypass setters + run_test_actions([ + TestAction::run_harness(), + TestAction::run(indoc! {r#" + var array = [1]; + Object.defineProperty(Array.prototype, "1", { + set(_val) { + Object.freeze(array); + }, + }); + "#}), + TestAction::assert_native_error( + "array.unshift(0)", + JsNativeErrorKind::Type, + "cannot set non-writable property: 0", + ), + ]); } #[test]