2 Commits

Author	SHA1	Message	Date
Georg Neis	92cde630df	Check length in Array.prototype.concat. ... Throw a TypeError if the length of a concat-spreadable object makes the total length too large, as specified. Bug: v8:7652 Change-Id: Ie3f694d64c949703edd733c0310cfb3f64b78a15 Reviewed-on: https://chromium-review.googlesource.com/1013714 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52644}	2018-04-17 13:04:18 +00:00
Georg Neis	00a3bfacb9	Check new length in array splice and unshift. ... If the new length is too large, we must throw a TypeError. Bug: v8:7652 Change-Id: I47268c04405f7a5f5bbc971cd434f2d786af9ca1 Reviewed-on: https://chromium-review.googlesource.com/1013563 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52624}	2018-04-16 16:26:33 +00:00