Check that array length stays a safe integer in Array.prototype.push

test/mjsunit/harmony/array-length.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-tolength
 
 // Test array functions do not cause infinite loops when length is negative,
 // max_value, etc.
 
 // ArrayToString
@@ skipping 15 matching lines @@
 assertEquals(0, result.length);
 
 // ArrayPush
 
 var o = { length: Number.MIN_VALUE };
 Array.prototype.push.call(o, 1);
 assertEquals(1, o.length);
 assertEquals(1, o[0]);
 
 var o = { length: Number.MAX_VALUE };
-Array.prototype.push.call(o, 1);
-assertEquals(o.length, Number.MAX_SAFE_INTEGER + 1);
-assertEquals(1, o[Number.MAX_SAFE_INTEGER]);
-
-Array.prototype.push.call(o, 2);
-assertEquals(o.length, Number.MAX_SAFE_INTEGER + 1);
-assertEquals(2, o[Number.MAX_SAFE_INTEGER]);
+assertThrows(() => Array.prototype.push.call(o, 1), TypeError);
 
 // ArrayPop
 
 var o = { length: 0 };
 Array.prototype.pop.call(o);
 assertEquals(0, o.length);
 
 var o = { length: Number.MIN_VALUE };
 Array.prototype.pop.call(o);
 assertEquals(0, o.length);
@@ skipping 146 matching lines @@
 
 var o = { length: Number.MIN_VALUE };
 Array.prototype.reduceRight.call(o, func, 0);
 assertEquals(Number.MIN_VALUE, o.length);
 
 // ArrayFill
 
 var o = { length: Number.MIN_VALUE };
 Array.prototype.fill(o, 0);
 assertEquals(Number.MIN_VALUE, o.length);