Use DefineOwnComputed in arraySpread.

Summary:
It's incorrect to use putComputed in array spread to populate the array,
as the spec requires [[DefineOwnComputed]].

Reviewed By: Huxpro

Differential Revision: D23378314

fbshipit-source-id: 48b67c23e9ab14d2c3e85cb6d6ccec870c61780f

lib/VM/JSLib/HermesBuiltin.cpp

@@ -614,8 +614,12 @@ hermesBuiltinArraySpread(void *, Runtime *runtime, NativeArgs args) {
     //    ToString(ToUint32(nextIndex)), nextValue).
     // e. Assert: status is true.
     if (LLVM_UNLIKELY(
-            JSArray::putComputed_RJS(target, runtime, nextIndex, nextValue) ==
-            ExecutionStatus::EXCEPTION)) {
+            JSArray::defineOwnComputed(
+                target,
+                runtime,
+                nextIndex,
+                DefinePropertyFlags::getDefaultNewPropertyFlags(),
+                nextValue) == ExecutionStatus::EXCEPTION)) {
       return ExecutionStatus::EXCEPTION;
     }
 
@@ -671,7 +675,11 @@ hermesBuiltinApply(void *, Runtime *runtime, NativeArgs args) {
     return runtime->raiseStackOverflow(Runtime::StackOverflowKind::NativeStack);
 
   for (uint32_t i = 0; i < len; ++i) {
-    newFrame->getArgRef(i) = argArray->at(runtime, i);
+    assert(!argArray->at(runtime, i).isEmpty() && "arg array must be dense");
+    HermesValue arg = argArray->at(runtime, i);
+    newFrame->getArgRef(i) = LLVM_UNLIKELY(arg.isEmpty())
+        ? HermesValue::encodeUndefinedValue()
+        : arg;
   }
   if (isConstructor) {
     auto res = Callable::construct(fn, runtime, thisVal);

test/hermes/es6/array-spread-proto.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright (c) Facebook, Inc. and its affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+// RUN: %hermes -O %s | %FileCheck --match-full-lines %s
+// RUN: %hermes -O -emit-binary -out %t.hbc %s && %hermes %t.hbc | %FileCheck --match-full-lines %s
+
+// Ensure that overriding slots in the array prototype doesn't break spread,
+// because array spreading uses DefineOwnProperty.
+Object.defineProperty(Array.prototype, 0, {});
+
+print([..."asd"])
+// CHECK: a,s,d
+
+print([...['a', 's', 'd']])
+// CHECK: a,s,d