Avoid calling %AddElement with a number out of array index range

src/js/runtime.js

Index: src/js/runtime.js
diff --git a/src/js/runtime.js b/src/js/runtime.js
index 7e2f12b7d2c3e0d713c5b53fbf647bfaf4b2aa8a..55a1b862148e4eb22b57c821d0ef244c6127a54d 100644
--- a/src/js/runtime.js
+++ b/src/js/runtime.js
@@ -194,7 +194,7 @@ function SameValueZero(x, y) {
 function ConcatIterableToArray(target, iterable) {
    var index = target.length;
    for (var element of iterable) {
-     %AddElement(target, index++, element);
+     AddLargeElement(target, index++, element);
    }
    return target;
 }
@@ -206,6 +206,19 @@ function ConcatIterableToArray(target, iterable) {
 */
 
 
+// This function should be called rather than %AddElement in contexts where the
+// argument might not be less than 2**32-1. ES2015 ToLength semantics mean that
+// this is a concern at basically all callsites.
+function AddLargeElement(obj, index, value) {

[adamk, 2015/10/27 22:03:07]

Bikeshedding: "LargeElement" sounds to me like the value is large, not the key.
What about "AddIndexedProperty"?

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

[adamk, 2015/10/28 19:52:50]

Hmm, "IndexedElement" sounds redundant given the V8 meaning of "element". Can
you change this to "IndexedProperty"?

+  if (index === index >>> 0) {

[adamk, 2015/10/27 22:03:07]

We have a macro for the RHS of this, TO_UINT32(index), please call that instead.

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

+    %AddElement(obj, index, value);
+  } else {
+    %AddNamedProperty(obj, GlobalString(index), value, 0);

[adamk, 2015/10/27 22:03:07]

Two things:

- Please use TO_STRING() instead of GlobalString()
- "0" is spelled "NONE" in macros.py

[Dan Ehrenberg, 2015/10/28 18:44:43]

Done

+  }
+}
+%SetForceInlineFlag(AddLargeElement);
+
+
 // ES6, draft 10-14-14, section 22.1.3.1.1
 function IsConcatSpreadable(O) {
   if (!IS_SPEC_OBJECT(O)) return false;
@@ -248,6 +261,7 @@ function MinSimple(a, b) {
 // Exports
 
 utils.Export(function(to) {
+  to.AddLargeElement = AddLargeElement;
   to.MaxSimple = MaxSimple;
   to.MinSimple = MinSimple;
   to.SameValue = SameValue;