Correctly handle Array unshift/splices that move elements past the max length of an Array

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declarations have been made
 // in runtime.js:
 // var $Array = global.Array;
 
@@ skipping 220 matching lines @@
   }
 }
 
 
 // This function implements the optimized splice implementation that can use
 // special array operations to handle sparse arrays in a sensible fashion.
 function SparseMove(array, start_i, del_count, len, num_additional_args) {
   // Bail out if no moving is necessary.
   if (num_additional_args === del_count) return;
   // Move data to new array.
-  var new_array = new InternalArray(len - del_count + num_additional_args);
+  var new_array = new InternalArray(
+      // Clamp array length to 2^32-1 to avoid early RangeError.
+      MathMin(len - del_count + num_additional_args, 0xffffffff));
+  var big_indices;
   var indices = %GetArrayKeys(array, len);
   if (IS_NUMBER(indices)) {
     var limit = indices;
     for (var i = 0; i < start_i && i < limit; ++i) {
       var current = array[i];
       if (!IS_UNDEFINED(current) || i in array) {
         new_array[i] = current;
       }
     }
     for (var i = start_i + del_count; i < limit; ++i) {
       var current = array[i];
       if (!IS_UNDEFINED(current) || i in array) {
         new_array[i - del_count + num_additional_args] = current;
       }
     }
   } else {
     var length = indices.length;
     for (var k = 0; k < length; ++k) {
       var key = indices[k];
       if (!IS_UNDEFINED(key)) {
         if (key < start_i) {
           var current = array[key];
           if (!IS_UNDEFINED(current) || key in array) {
             new_array[key] = current;
           }
         } else if (key >= start_i + del_count) {
           var current = array[key];
           if (!IS_UNDEFINED(current) || key in array) {
-            new_array[key - del_count + num_additional_args] = current;
+            var new_key = key - del_count + num_additional_args;
+            new_array[new_key] = current;
+            if (new_key > 0xffffffff) {

[Toon Verwaest, 2014/11/11 13:22:21]

Shouldn't this be >=?

NOTE A String property name P is an array index if and only if
ToString(ToUint32(P)) is equal to P and ToUint32(P) is not equal to 2^
32-1.

[adamk, 2014/11/11 18:01:01]

This is a weird corner-case in V8: indexed property 0xffffffff is stored in the
elements backing store, despite not being a valid array index. I guess I could
make it >=, but it's well covered by the tests in case we change elements
implementation.

+              big_indices = big_indices || new InternalArray();
+              big_indices.push(new_key);
+            }
           }
         }
       }
     }
   }
   // Move contents of new_array into this array
   %MoveArrayContents(new_array, array);
+  // Add any moved values that aren't elements anymore.
+  if (!IS_UNDEFINED(big_indices)) {
+    var length = big_indices.length;
+    for (var i = 0; i < length; ++i) {
+      var key = big_indices[i];
+      array[key] = new_array[key];
+    }
+  }
 }
 
 
 // This is part of the old simple-minded splice.  We are using it either
 // because the receiver is not an array (so we have no choice) or because we
 // know we are not deleting or moving a lot of elements.
 function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
   for (var i = 0; i < del_count; i++) {
     var index = start_i + i;
     if (index in array) {
@@ skipping 1268 matching lines @@
   ));
 
   SetUpLockedPrototype(InternalPackedArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();