Avoid calling %AddElement with a number out of array index range

src/js/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This files contains runtime support implemented in JavaScript.
 
 // CAUTION: Some of the functions specified in this file are called
 // directly from compiled code. These are the functions with names in
 // ALL CAPS. The compiled code passes the first argument in 'this'.
 
@@ skipping 176 matching lines @@
     if (NUMBER_IS_NAN(x) && NUMBER_IS_NAN(y)) return true;
   }
   if (IS_SIMD_VALUE(x)) return %SimdSameValueZero(x, y);
   return x === y;
 }
 
 
 function ConcatIterableToArray(target, iterable) {
    var index = target.length;
    for (var element of iterable) {
-     %AddElement(target, index++, element);
+     AddLargeElement(target, index++, element);
    }
    return target;
 }
 
 
 /* ---------------------------------
    - - -   U t i l i t i e s   - - -
    ---------------------------------
 */
 
 
+// This function should be called rather than %AddElement in contexts where the
+// argument might not be less than 2**32-1. ES2015 ToLength semantics mean that
+// this is a concern at basically all callsites.
+function AddLargeElement(obj, index, value) {

[adamk, 2015/10/27 22:03:07]

Bikeshedding: "LargeElement" sounds to me like the value is large, not the key.
What about "AddIndexedProperty"?

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

[adamk, 2015/10/28 19:52:50]

Hmm, "IndexedElement" sounds redundant given the V8 meaning of "element". Can
you change this to "IndexedProperty"?

+  if (index === index >>> 0) {

[adamk, 2015/10/27 22:03:07]

We have a macro for the RHS of this, TO_UINT32(index), please call that instead.

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

+    %AddElement(obj, index, value);
+  } else {
+    %AddNamedProperty(obj, GlobalString(index), value, 0);

[adamk, 2015/10/27 22:03:07]

Two things:

- Please use TO_STRING() instead of GlobalString()
- "0" is spelled "NONE" in macros.py

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

+  }
+}
+%SetForceInlineFlag(AddLargeElement);
+
+
 // ES6, draft 10-14-14, section 22.1.3.1.1
 function IsConcatSpreadable(O) {
   if (!IS_SPEC_OBJECT(O)) return false;
   var spreadable = O[isConcatSpreadableSymbol];
   if (IS_UNDEFINED(spreadable)) return IS_ARRAY(O);
   return TO_BOOLEAN(spreadable);
 }
 
 
 function ToPositiveInteger(x, rangeErrorIndex) {
@@ skipping 22 matching lines @@
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype(GlobalArray, new GlobalArray(0));
 
 // ----------------------------------------------------------------------------
 // Exports
 
 utils.Export(function(to) {
+  to.AddLargeElement = AddLargeElement;
   to.MaxSimple = MaxSimple;
   to.MinSimple = MinSimple;
   to.SameValue = SameValue;
   to.SameValueZero = SameValueZero;
   to.ToPositiveInteger = ToPositiveInteger;
 });
 
 %InstallToContext([
   "apply_prepare_builtin", APPLY_PREPARE,
   "concat_iterable_to_array_builtin", CONCAT_ITERABLE_TO_ARRAY,
   "reflect_apply_prepare_builtin", REFLECT_APPLY_PREPARE,
   "reflect_construct_prepare_builtin", REFLECT_CONSTRUCT_PREPARE,
 ]);
 
 %InstallToContext([
   "concat_iterable_to_array", ConcatIterableToArray,
 ]);
 
 })