[Webkit-unassigned] [Bug 55033] New: Array.prototype.push should throw RangeError if the length overflows

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=55033

           Summary: Array.prototype.push should throw RangeError if the
                    length overflows
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: kent.hansen at nokia.com


The following script

a = new Array(4294967295); a.push('foo')

doesn't cause an error with JavaScriptCore. Instead, the push seemingly succeeds, but you end up with an array of length 0.
Both V8 and SpiderMonkey throw a RangeError in this case. That's correct as per ECMA-262 5th edition; it happens due to step 6 in section 15.4.4.7. In particular, see section 15.4.5.1, steps 3c and 3d.
In summary: push() should create a property with name "4294967295" (not an array index), but the array length should not be changed, and a RangeError should be thrown.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.