92cde630df
Throw a TypeError if the length of a concat-spreadable object makes the total length too large, as specified. Bug: v8:7652 Change-Id: Ie3f694d64c949703edd733c0310cfb3f64b78a15 Reviewed-on: https://chromium-review.googlesource.com/1013714 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52644}
27 lines
775 B
JavaScript
27 lines
775 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
const splice = Array.prototype.splice;
|
|
const unshift = Array.prototype.unshift;
|
|
|
|
{
|
|
let a = {length: 2**53 - 1};
|
|
assertThrows(() => unshift.call(a, 42), TypeError);
|
|
assertEquals(unshift.call(a), 2**53 - 1);
|
|
}
|
|
|
|
{
|
|
let a = {length: 2**53 - 1};
|
|
assertThrows(() => splice.call(a, 0, 0, 42), TypeError);
|
|
assertEquals(splice.call(a, 0, 1, 42).length, 1);
|
|
assertEquals(a[0], 42);
|
|
}
|
|
|
|
{
|
|
let a = {length: 2**53 - 1, [Symbol.isConcatSpreadable]: true};
|
|
assertThrows(() => [42].concat(a), TypeError);
|
|
assertThrows(() => [, ].concat(a), TypeError);
|
|
assertThrows(() => [].concat(42, a), TypeError);
|
|
}
|