Update Array.prototype.concat error handling to ES11 (#4071)

This patch fixes #4044.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu

jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c

@@ -301,7 +301,11 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array *
   }
 
   bool spread_object = is_spreadable == ECMA_VALUE_TRUE;
+  /* ES11: 22.1.3.1.5.c.iv.3.b */
+  const uint32_t prop_flags = ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE | ECMA_IS_THROW;
 #else /* !ENABLED (JERRY_ESNEXT) */
+  /* ES5.1: 15.4.4.4.5.b.iii.3.b */
+  const uint32_t prop_flags = ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE;
   bool spread_object = ecma_is_value_true (ecma_is_value_array (value));
 #endif /* ENABLED (JERRY_ESNEXT) */
 
@@ -342,10 +346,16 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array *
       ecma_value_t put_comp = ecma_builtin_helper_def_prop_by_index (array_obj_p,
                                                                      *length_p + array_index,
                                                                      get_value,
-                                                                     ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE);
+                                                                     prop_flags);
-
-      JERRY_ASSERT (ecma_is_value_true (put_comp));
       ecma_free_value (get_value);
+#if ENABLED (JERRY_ESNEXT)
+      if (ECMA_IS_VALUE_ERROR (put_comp))
+      {
+        return put_comp;
+      }
+#else /* !ENABLED (JERRY_ESNEXT) */
+      JERRY_ASSERT (ecma_is_value_true (put_comp));
+#endif /* ENABLED (JERRY_ESNEXT) */
     }
 
     *length_p += arg_len;
@@ -357,8 +367,16 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array *
   ecma_value_t put_comp = ecma_builtin_helper_def_prop_by_index (array_obj_p,
                                                                  (*length_p)++,
                                                                  value,
-                                                                 ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE);
+                                                                 prop_flags);
+
+#if ENABLED (JERRY_ESNEXT)
+  if (ECMA_IS_VALUE_ERROR (put_comp))
+  {
+    return put_comp;
+  }
+#else /* !ENABLED (JERRY_ESNEXT) */
   JERRY_ASSERT (ecma_is_value_true (put_comp));
+#endif /* ENABLED (JERRY_ESNEXT) */
 
   return ECMA_VALUE_EMPTY;
 } /* ecma_builtin_helper_array_concat_value */

tests/jerry/es.next/regression-test-issue-4044.js

@@ -0,0 +1,28 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var a = Int32Array.prototype;
+a.__proto__ = [];
+
+var b = a.splice(7, -4, 8, 9, 10);
+
+b.__proto__ = a;
+b.length = 5;
+
+try {
+  b = b.concat([]);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}