0dd0af7baf
This matches the pre-torque behavior when the receiver's length was greater than the max array length. Bug: chromium:902672 Change-Id: Icf8ae3a1a4acc0680ce1b709f5b3372892337203 Reviewed-on: https://chromium-review.googlesource.com/c/1330921 Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#57456}
9 lines
313 B
JavaScript
9 lines
313 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var a = this;
|
|
var b = {};
|
|
a.length = 4294967296; // 2 ^ 32 (max array length + 1)
|
|
assertThrows(() => Array.prototype.join.call(a,b), TypeError);
|