Modify %AddElement to accept large indices out of array bounds

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
@@ skipping 489 matching lines @@
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
       JSObject::SetOwnPropertyIgnoreAttributes(object, name, value, attrs));
   return *result;
 }
 
 
 // Adds an element to an array.
 // This is used to create an indexed data property into an array.
+// TODO(littledan): Eliminate AddElement and switch to something less hacky.
 RUNTIME_FUNCTION(Runtime_AddElement) {
   HandleScope scope(isolate);
   RUNTIME_ASSERT(args.length() == 3);
 
   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 
   uint32_t index = 0;
-  CHECK(key->ToArrayIndex(&index));
+
+  Handle<Object> result;
+  if (key->ToArrayIndex(&index)) {
+#ifdef DEBUG
+    LookupIterator it(isolate, object, index,
+                      LookupIterator::OWN_SKIP_INTERCEPTOR);
+    Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
+    if (!maybe.IsJust()) return isolate->heap()->exception();
+    RUNTIME_ASSERT(!it.IsFound());
+
+    if (object->IsJSArray()) {
+      Handle<JSArray> array = Handle<JSArray>::cast(object);
+      RUNTIME_ASSERT(!JSArray::WouldChangeReadOnlyLength(array, index));
+    }
+#endif
+
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, result,
+        JSObject::SetOwnElementIgnoreAttributes(object, index, value, NONE));
+  } else {
+    MaybeHandle<Name> maybe_name = Object::ToName(isolate, key);
+    Handle<Name> name = maybe_name.ToHandleChecked();
 
 #ifdef DEBUG
-  LookupIterator it(isolate, object, index,
-                    LookupIterator::OWN_SKIP_INTERCEPTOR);
-  Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-  if (!maybe.IsJust()) return isolate->heap()->exception();
-  RUNTIME_ASSERT(!it.IsFound());
-
-  if (object->IsJSArray()) {
-    Handle<JSArray> array = Handle<JSArray>::cast(object);
-    RUNTIME_ASSERT(!JSArray::WouldChangeReadOnlyLength(array, index));
-  }
+    LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+    Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
+    if (!maybe.IsJust()) return isolate->heap()->exception();
+    RUNTIME_ASSERT(!it.IsFound());
 #endif
 
-  Handle<Object> result;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result,
-      JSObject::SetOwnElementIgnoreAttributes(object, index, value, NONE));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, result,
+        JSObject::SetOwnPropertyIgnoreAttributes(object, name, value, NONE));
+  }
   return *result;
 }
 
 
 RUNTIME_FUNCTION(Runtime_AppendElement) {
   HandleScope scope(isolate);
   RUNTIME_ASSERT(args.length() == 2);
 
   CONVERT_ARG_HANDLE_CHECKED(JSArray, array, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
@@ skipping 1026 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ObjectDefineProperties) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, o, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, properties, 1);
   return JSReceiver::DefineProperties(isolate, o, properties);
 }
 }  // namespace internal
 }  // namespace v8