Use proper ToLength() operation in %ArrayConcat()

test/mjsunit/harmony/array-concat.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-arrays --harmony-classes
 
 (function testArrayConcatArity() {
   "use strict";
   assertEquals(1, Array.prototype.concat.length);
 })();
@@ skipping 22 matching lines @@
   };
   obj[Symbol.isConcatSpreadable] = true;
   var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
   var arr = ["X", "Y", "Z"];
   assertEquals([void 0, "A", void 0, "B", void 0, "C",
                { "length": 3, "0": "0", "1": "1", "2": "2" },
                "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
 })();
 
 
+(function testConcatArrayLikeStringLength() {
+  "use strict";
+  var obj = {
+    "length": "6",
+    "1": "A",
+    "3": "B",
+    "5": "C"
+  };
+  obj[Symbol.isConcatSpreadable] = true;
+  var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+  var arr = ["X", "Y", "Z"];
+  assertEquals([void 0, "A", void 0, "B", void 0, "C",
+               { "length": 3, "0": "0", "1": "1", "2": "2" },
+               "X", "Y", "Z"], Array.prototype.concat.call(obj, obj2, arr));
+})();
+
+
+(function testConcatArrayLikeNegativeLength() {
+  "use strict";
+  var obj = {
+    "length": -6,
+    "1": "A",
+    "3": "B",
+    "5": "C"
+  };
+  obj[Symbol.isConcatSpreadable] = true;
+  assertEquals([], [].concat(obj));
+  obj.length = -6.7;
+  assertEquals([], [].concat(obj));
+  obj.length = "-6";
+  assertEquals([], [].concat(obj));
+})();
+
+
+(function testConcatArrayLikeToLengthThrows() {
+  "use strict";
+  var obj = {
+    "length": {valueOf: null, toString: null},

[Dmitry Lomov (no reviews), 2014/12/15 07:23:51]

Add a test where `toString` and `valueOf` throw an exception and validate that
the exception you get out of `concat` is exact same exception they throw.

[caitp (gmail), 2014/12/15 18:15:29]

Done

+    "1": "A",
+    "3": "B",
+    "5": "C"
+  };
+  obj[Symbol.isConcatSpreadable] = true;
+  var obj2 = { length: 3, "0": "0", "1": "1", "2": "2" };
+  var arr = ["X", "Y", "Z"];
+  assertThrows(function() {
+    Array.prototype.concat.call(obj, obj2, arr);
+  }, TypeError);
+})();
+
+
 (function testConcatHoleyArray() {
   "use strict";
   var arr = [];
   arr[4] = "Item 4";
   arr[8] = "Item 8";
   var arr2 = [".", "!", "?"];
   assertEquals([void 0, void 0, void 0, void 0, "Item 4", void 0, void 0,
                 void 0, "Item 8", ".", "!", "?"], arr.concat(arr2));
 })();
 
@@ skipping 351 matching lines @@
   arr3.length = 10000;
   for (var i = 0; i < 100; i++) {
     Object.defineProperty(arr3, i * i, {get: mkGetter(i)});
     expectedTrace[i] = i;
     expectedTrace[100 + i] = i;
   }
   var r4 = [0].concat(arr3, arr3);
   assertEquals(1 + arr3.length * 2, r4.length);
   assertEquals(expectedTrace, trace);
 })();