« Bugzilla Issues Index

#1854 — Add ToUint32() to ensure array invariant

Arrays are currently still restricted to a maximum length of 2^32, but the ArrayCreate() method does not ensure that invariant. This is visible after the latest changes to introduce ToLength().

test case:
---{length: 1 + Math.pow(2, 32)}, (x) => x)

This will call ArrayCreate() with a length of 1 + 2^32, and then set the "length" property to that value, violating the array invariant.

fixed in rev20 editor's draft

fixed in rev20 draft, Oct. 28, 2013