// Copyright (C) 2016 the V8 project authors. All rights reserved. // This code is governed by the BSD license found in the LICENSE file. /*--- esid: sec-array.prototype.slice description: > Ensure a RangeError is thrown when a proxied array returns an invalid array length. info: | [...] 8. Let A be ? ArraySpeciesCreate(O, count). [...] 9.4.2.3 ArraySpeciesCreate [...] 3. Let isArray be ? IsArray(originalArray). [...] 5. Let C be ? Get(originalArray, "constructor"). [...] 10. Return ? Construct(C, « length »). 9.4.2.2 ArrayCreate [...] 3. If length>2^32-1, throw a RangeError exception. features: [Proxy] ---*/ var array = []; var maxLength = Math.pow(2, 32); var callCount = 0; var proxy = new Proxy(array, { get: function(_, name) { if (name === 'length') { return maxLength; } return array[name]; }, set: function() { callCount += 1; return true; } }); assert.throws(RangeError, function() { Array.prototype.slice.call(proxy); }); assert.sameValue( callCount, 0, 'RangeError thrown during array creation, not property modification' ); reportCompare(0, 0);