From https://mail.mozilla.org/pipermail/es-discuss/2014-October/040110.html
> Somewhat related: Does it make sense to check if the length will exceed the 2^53-1 limit? And is
> ToString(9007199254740993) properly defined, where 9007199254740993 is a mathematical real number as
> defined in "5.2 Algorithm Conventions". As I understand it, ToString (7.1.12) is not defined for
> arbitrary numbers, but only for the Number type ("6.1.6 The Number Type").
>
> A simple example where this issue arises:
> ---
> var a = {length: Math.pow(2,53)-1};
> Array.prototype.push.call(a, ..."abc");
> print(a["9007199254740991"]); // ?
> print(a["9007199254740992"]); // ?
> print(a["9007199254740993"]); // ?
> ---
fixed in rev30 editor's draft
Array.prototype.concat/push/splice throw TypeError if new length would be 2^53 or greater.
(In reply to Allen Wirfs-Brock from comment #1)
> fixed in rev30 editor's draft
>
> Array.prototype.concat/push/splice throw TypeError if new length would be
> 2^53 or greater.
What about Array.prototype.unshift ?
and unshift
fixed in rev30