archives

« Bugzilla Issues Index

#3802 — 9.4.2.2 ArrayCreate checks length is <=2^32-1, whereas everything else checks for Number.MAX_SAFE_INTEGER


everywhere else where integers are range checked before creating/modifying arrays, the check is against 2^53-1, such as

Array.prototype.concat:
7.d.iv. If n + len > 2^53-1, throw a TypeError exception.

Array.prototype.push:
7. If len + argCount ≥ 2^53-1, throw a TypeError exception.

...


But ArrayCreate checks against 2^31-1:
3. If length>2^32-1, throw a RangeError exception.

shouldn't this also be ">2^53-1" instead?


nope, Array's instances are explicitly limited to a length of 2^32-1 because of legacy compatibility issues.

However, the generic array methods, which can be used with non-Array instances use the larger limit. When they are applied to actual array instances they should wrap (in a legacy compatible manner) because of the ToUint32 call in the [[DefineOwnProperty]] internal method of exotic array objects.