summaryrefslogtreecommitdiffstats
path: root/js/src/tests/test262/built-ins/Array/prototype/concat/arg-length-exceeding-integer-limit.js
blob: 3e997498e963c021eb74ae68040332a48841b775 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-array.prototype.concat
description: >
  TypeError is thrown if "length" of result array exceeds 2^53 - 1.
info: |
  Array.prototype.concat ( ...arguments )

  [...]
  5. Repeat, while items is not empty
    [...]
    c. If spreadable is true, then
      [...]
      ii. Let len be ? LengthOfArrayLike(E).
      iii. If n + len > 2^53 - 1, throw a TypeError exception.
    [...]
features: [Symbol.isConcatSpreadable, Proxy]
---*/

var spreadableLengthOutOfRange = {};
spreadableLengthOutOfRange.length = Number.MAX_SAFE_INTEGER;
spreadableLengthOutOfRange[Symbol.isConcatSpreadable] = true;

assert.throws(TypeError, function() {
  [1].concat(spreadableLengthOutOfRange);
}, '[1].concat(spreadableLengthOutOfRange) throws a TypeError exception');

var proxyForArrayWithLengthOutOfRange = new Proxy([], {
  get: function(_target, key) {
    if (key === "length") {
      return Number.MAX_SAFE_INTEGER;
    }
  },
});

assert.throws(TypeError, function() {
  [].concat(1, proxyForArrayWithLengthOutOfRange);
}, '[].concat(1, proxyForArrayWithLengthOutOfRange) throws a TypeError exception');

reportCompare(0, 0);