summaryrefslogtreecommitdiffstats
path: root/js/src/tests/test262/built-ins/Array/prototype/concat/arg-length-near-integer-limit.js
blob: 438f520e16491d186c90b961a9063de7bc5a182e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-array.prototype.concat
description: >
  Elements are copied from a spreadable array-like object
  whose "length" property is near the integer limit.
info: |
  Array.prototype.concat ( ...arguments )

  [...]
  5. Repeat, while items is not empty
    [...]
    c. If spreadable is true, then
      [...]
      ii. Let len be ? LengthOfArrayLike(E).
      iii. If n + len > 2^53 - 1, throw a TypeError exception.
      iv. Repeat, while k < len
        [...]
        3. If exists is true, then
          a. Let subElement be ? Get(E, P).
    [...]
features: [Symbol.isConcatSpreadable]
---*/

var spreadableHasPoisonedIndex = {
  length: Number.MAX_SAFE_INTEGER,
  get 0() {
    throw new Test262Error();
  },
};
spreadableHasPoisonedIndex[Symbol.isConcatSpreadable] = true;

assert.throws(Test262Error, function() {
  [].concat(spreadableHasPoisonedIndex);
}, '[].concat(spreadableHasPoisonedIndex) throws a Test262Error exception');

reportCompare(0, 0);