Avoid calling %AddElement with a number out of array index range

src/js/harmony-array.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
+var AddLargeElement;
 var FLAG_harmony_tolength;
 var GetIterator;
 var GetMethod;
 var GlobalArray = global.Array;
 var iteratorSymbol = utils.ImportNow("iterator_symbol");
 var MakeTypeError;
 var MaxSimple;
 var MinSimple;
 var ObjectIsFrozen;
 var ObjectDefineProperty;
 
 utils.Import(function(from) {
+  AddLargeElement = from.AddLargeElement;
   FLAG_harmony_tolength = from.FLAG_harmony_tolength;
   GetIterator = from.GetIterator;
   GetMethod = from.GetMethod;
   MakeTypeError = from.MakeTypeError;
   MaxSimple = from.MaxSimple;
   MinSimple = from.MinSimple;
   ObjectIsFrozen = from.ObjectIsFrozen;
   ObjectDefineProperty = from.ObjectDefineProperty;
 });
 
@@ skipping 137 matching lines @@
 // ES6, draft 04-05-14, section 22.1.3.6
 function ArrayFill(value, start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
   var length = TO_LENGTH_OR_UINT32(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }
 
 function AddArrayElement(constructor, array, i, value) {

[adamk, 2015/10/27 22:03:07]

Do we still need this wrapper? Is it guarding something different than the one
you're adding?

[Dan Ehrenberg, 2015/10/28 18:44:43]

I had the same impulse at first, to remove it, but I don't think it's legitimate
to assume that a random object has an array backing store. I think in the other
cases, we are able to call %AddElement because we're constructing a new array,
but that's not the case for Array.from, Array.of when called with another object
as the receiver.

[adamk, 2015/10/28 19:52:50]

All objects have en element backing store for indexed properties that are
representable as a uint32. As long as the property is known to not pre-exist on
the instance, %AddElement should be safe.

[adamk, 2015/10/28 20:03:07]

But Array.from and Array.of call arbitrary user code to construct their objects,
so there's no guarantee about the non-existence of properties on the object. So
I'm wrong, and this should stay as-is.

   if (constructor === GlobalArray) {
-    %AddElement(array, i, value);
+    AddLargeElement(array, i, value);
   } else {
     ObjectDefineProperty(array, i, {
       value: value, writable: true, configurable: true, enumerable: true
     });
   }
 }
 
 // ES6, draft 10-14-14, section 22.1.2.1
 function ArrayFrom(arrayLike, mapfn, receiver) {
   var items = TO_OBJECT(arrayLike);
@@ skipping 97 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayFrom = ArrayFrom;
   to.InnerArrayCopyWithin = InnerArrayCopyWithin;
   to.InnerArrayFill = InnerArrayFill;
   to.InnerArrayFind = InnerArrayFind;
   to.InnerArrayFindIndex = InnerArrayFindIndex;
 });
 
 })