ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

test/mjsunit/harmony/array-length.js

Index: test/mjsunit/harmony/array-length.js
diff --git a/test/mjsunit/harmony/array-length.js b/test/mjsunit/harmony/array-length.js
new file mode 100644
index 0000000000000000000000000000000000000000..3fc8f97639e4dc9c1d08ee73bb7a3a9a1a4656e9
--- /dev/null
+++ b/test/mjsunit/harmony/array-length.js
@@ -0,0 +1,225 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony-arrays
+
+// Test array functions do not cause infinite loops when length is negative,
+// max_value, etc.
+
+// ArrayToString
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.toString.call(o);
+assertEquals("[object Object]", result);
+
+// ArrayToLocaleString
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.toLocaleString.call(o);
+assertEquals("", result);
+
+// ArrayJoin
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.join.call(o);
+assertEquals(0, result.length);
+
+// ArrayPush
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.push.call(o, 1);
+assertEquals(1, o.length);
+assertEquals(1, o[0]);
+
+var o = { length: Number.MAX_VALUE };
+Array.prototype.push.call(o, 1);
+assertEquals(o.length, Number.MAX_SAFE_INTEGER + 1);
+assertEquals(1, o[Number.MAX_SAFE_INTEGER]);
+
+Array.prototype.push.call(o, 2);
+assertEquals(o.length, Number.MAX_SAFE_INTEGER + 1);
+assertEquals(2, o[Number.MAX_SAFE_INTEGER]);
+
+// ArrayPop
+
+var o = { length: 0 };
+Array.prototype.pop.call(o);
+assertEquals(0, o.length);
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.pop.call(o);
+assertEquals(0, o.length);
+
+var o = { length: Number.MAX_VALUE };
+Array.prototype.pop.call(o);
+assertEquals(o.length, Number.MAX_SAFE_INTEGER - 1);
+
+// ArrayReverse
+
+var o = { 0: 'foo', length: Number.MIN_VALUE }
+var result = Array.prototype.reverse.call(o);
+assertEquals('object', typeof(result));
+assertEquals(Number.MIN_VALUE, result.length);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayShift
+
+var o = { 0: "foo", length: Number.MIN_VALUE }
+var result = Array.prototype.shift.call(o);
+assertEquals(undefined, result);
+assertEquals(0, o.length);
+
+// ArrayUnshift
+
+var o = { length: 0 };
+Array.prototype.unshift.call(o);
+assertEquals(0, o.length);
+
+var o = { length: 0 };
+Array.prototype.unshift.call(o, 'foo');
+assertEquals('foo', o[0]);
+assertEquals(1, o.length);
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.unshift.call(o);
+assertEquals(0, o.length);
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.unshift.call(o, 'foo');
+assertEquals('foo', o[0]);
+assertEquals(1, o.length);
+
+// ArraySplice
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.splice.call(o);
+assertEquals(0, o.length);
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.splice.call(o, 0, 10, ['foo']);
+assertEquals(['foo'], o[0]);
+assertEquals(1, o.length);
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.splice.call(o, -1);
+assertEquals(0, o.length);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+Array.prototype.splice.call(o, -1);
+assertEquals(Number.MAX_SAFE_INTEGER - 1, o.length);
+
+// ArraySlice
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.slice.call(o);
+assertEquals(0, result.length);
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.slice.call(o, Number.MAX_VALUE);
+assertEquals(0, result.length);
+
+var o = { length: Number.MAX_VALUE };
+var result = Array.prototype.slice.call(o, Number.MAX_VALUE - 1);
+assertEquals(0, result.length);
+
+// ArrayIndexOf
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.indexOf.call(o);
+assertEquals(-1, result);
+
+var o = { length: Number.MAX_SAFE_INTEGER }
+o[Number.MAX_SAFE_INTEGER - 1] = "foo"
+var result = Array.prototype.indexOf.call(o,
+    "foo", Number.MAX_SAFE_INTEGER - 2);
+assertEquals(Number.MAX_SAFE_INTEGER - 1, result);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+o[Number.MAX_SAFE_INTEGER - 1] = "foo";
+var result = Array.prototype.indexOf.call(o, "foo", -1);
+assertEquals(Number.MAX_SAFE_INTEGER - 1, result);
+
+// ArrayLastIndexOf
+
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.lastIndexOf.call(o);
+assertEquals(-1, result);
+
+var o = { length: Number.MAX_SAFE_INTEGER }
+o[Number.MAX_SAFE_INTEGER - 1] = "foo"
+var result = Array.prototype.lastIndexOf.call(o,
+    "foo", Number.MAX_SAFE_INTEGER);
+assertEquals(Number.MAX_SAFE_INTEGER - 1, result);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+o[Number.MAX_SAFE_INTEGER - 1] = "foo";
+var result = Array.prototype.lastIndexOf.call(o, "foo", -1);
+assertEquals(Number.MAX_SAFE_INTEGER - 1, result);
+
+// ArrayFilter
+
+var func = function(v) { return v; }
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.filter.call(o, func);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayForEach
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.forEach.call(o, func);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArraySome
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.some.call(o, func);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayEvery
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.every.call(o, func);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayMap
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.map.call(o, func);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayReduce
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.reduce.call(o, func, 0);
+assertEquals(Number.MIN_VALUE, o.length);
+
+// ArrayReduceRight
+
+var o = { length: Number.MIN_VALUE };
+Array.prototype.reduceRight.call(o, func, 0);
+assertEquals(Number.MIN_VALUE, o.length);