Avoid calling %AddElement with a number out of array index range

src/js/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This files contains runtime support implemented in JavaScript.
 
 // CAUTION: Some of the functions specified in this file are called
 // directly from compiled code. These are the functions with names in
 // ALL CAPS. The compiled code passes the first argument in 'this'.
 
@@ skipping 176 matching lines @@
     if (NUMBER_IS_NAN(x) && NUMBER_IS_NAN(y)) return true;
   }
   if (IS_SIMD_VALUE(x)) return %SimdSameValueZero(x, y);
   return x === y;
 }
 
 
 function ConcatIterableToArray(target, iterable) {
    var index = target.length;
    for (var element of iterable) {
-     %AddElement(target, index++, element);
+     AddIndexedProperty(target, index++, element);
    }
    return target;
 }
 
 
 /* ---------------------------------
    - - -   U t i l i t i e s   - - -
    ---------------------------------
 */
 
 
+// This function should be called rather than %AddElement in contexts where the
+// argument might not be less than 2**32-1. ES2015 ToLength semantics mean that
+// this is a concern at basically all callsites.
+function AddIndexedProperty(obj, index, value) {
+  if (index === TO_UINT32(index)) {

[Toon Verwaest, 2015/10/29 10:41:01]

kMaxUint32 isn't a valid element either. Max length of arrays is kMaxUint32, so
max element is kMaxUint32-1.

+    %AddElement(obj, index, value);
+  } else {
+    %AddNamedProperty(obj, TO_STRING(index), value, NONE);
+  }
+}
+%SetForceInlineFlag(AddIndexedProperty);
+
+
 // ES6, draft 10-14-14, section 22.1.3.1.1
 function IsConcatSpreadable(O) {
   if (!IS_SPEC_OBJECT(O)) return false;
   var spreadable = O[isConcatSpreadableSymbol];
   if (IS_UNDEFINED(spreadable)) return IS_ARRAY(O);
   return TO_BOOLEAN(spreadable);
 }
 
 
 function ToPositiveInteger(x, rangeErrorIndex) {
@@ skipping 22 matching lines @@
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype(GlobalArray, new GlobalArray(0));
 
 // ----------------------------------------------------------------------------
 // Exports
 
 utils.Export(function(to) {
+  to.AddIndexedProperty = AddIndexedProperty;
   to.MaxSimple = MaxSimple;
   to.MinSimple = MinSimple;
   to.SameValue = SameValue;
   to.SameValueZero = SameValueZero;
   to.ToPositiveInteger = ToPositiveInteger;
 });
 
 %InstallToContext([
   "apply_prepare_builtin", APPLY_PREPARE,
   "concat_iterable_to_array_builtin", CONCAT_ITERABLE_TO_ARRAY,
   "reflect_apply_prepare_builtin", REFLECT_APPLY_PREPARE,
   "reflect_construct_prepare_builtin", REFLECT_CONSTRUCT_PREPARE,
 ]);
 
 %InstallToContext([
   "concat_iterable_to_array", ConcatIterableToArray,
 ]);
 
 })