summaryrefslogtreecommitdiffstats
path: root/js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-object.js
blob: 056478532c22c22420dfb1c910a0627929d4ca29 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
// Copyright (C) 2017 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-array.prototype.reverse
description: >
  Ensure reverse() implementation correctly handles length exceeding 2^53-1 with plain objects.
info: |
  ...
  2. Let len be ? ToLength(? Get(O, "length")).
  ...
features: [exponentiation]
---*/

function StopReverse() {}

// Object with large "length" property and no indexed properties in the uint32 range.
var arrayLike = {
  get "9007199254740990" () {
    throw new StopReverse();
  },
  get "9007199254740991" () {
    throw new Test262Error("Get 9007199254740991");
  },
  get "9007199254740992" () {
    throw new Test262Error("Get 9007199254740992");
  },
  length: 2 ** 53 + 2,
};

assert.throws(StopReverse, function() {
  Array.prototype.reverse.call(arrayLike);
});

reportCompare(0, 0);