js/src/jit-test/tests/ion/array-push-length-overflow.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14

function maybeSetLength(arr, b) {
    with(this) {};
    if (b)
        arr.length = 0x7fffffff;
}
function test() {
    var arr = [];
    for (var i=0; i<2000; i++) {
        maybeSetLength(arr, i > 1500);
        var res = arr.push(2);
        assertEq(res, i > 1500 ? 0x80000000 : i + 1);
    }
}
test();