From ea195cd131951551efa94587d6476ff05a3a2b01 Mon Sep 17 00:00:00 2001
From: Robert Fancsik <frobert@inf.u-szeged.hu>
Date: Thu, 7 Mar 2019 08:04:19 +0100
Subject: [PATCH] Use [[DefineOwnProperty]] in the iterator next step in
 ecma_builtin_promise_do_all (#2773)

This patch fixes #2770.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
---
 .../ecma/builtin-objects/ecma-builtin-promise.c  | 10 ++++++----
 tests/jerry/es2015/regression-test-issue-2770.js | 16 ++++++++++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-2770.js

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c b/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
index a0e5b47bf..1a0eec412 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
@@ -14,6 +14,7 @@
  */
 
 #include "ecma-array-object.h"
+#include "ecma-builtin-helpers.h"
 #include "ecma-exceptions.h"
 #include "ecma-function-object.h"
 #include "ecma-gc.h"
@@ -478,10 +479,11 @@ ecma_builtin_promise_do_all (ecma_value_t array, /**< the array for all */
       break;
     }
 
-    ecma_value_t put_ret = ecma_op_object_put (ecma_get_object_from_value (value_array),
-                                               index_to_str_p,
-                                               undefined_val,
-                                               false);
+    ecma_value_t put_ret = ecma_builtin_helper_def_prop (ecma_get_object_from_value (value_array),
+                                                         index_to_str_p,
+                                                         undefined_val,
+                                                         ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE,
+                                                         false);
     ecma_deref_ecma_string (index_to_str_p);
 
     if (ECMA_IS_VALUE_ERROR (put_ret))
diff --git a/tests/jerry/es2015/regression-test-issue-2770.js b/tests/jerry/es2015/regression-test-issue-2770.js
new file mode 100644
index 000000000..399662dca
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-2770.js
@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+Object.defineProperty(Array.prototype, 0, {set: function() { return Array.prototype.push(), Object.freeze(Array.prototype)}});
+Promise.all([0]);