diff --git a/CHANGELOG.md b/CHANGELOG.md index 975216b44be7..bba66ee934ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ ## Changelog ##### Unreleased - [Change `Array` by copy proposal](https://github.com/tc39/proposal-change-array-by-copy) moved to stage 3 +- `Array.prototype.toSpliced` throws a `TypeError` instead of `RangeError` in the result length is more than `MAX_SAFE_INTEGER`, [proposal-change-array-by-copy/70](https://github.com/tc39/proposal-change-array-by-copy/pull/70) - Stabilized proposals are filtered out from the `core-js-compat` / `core-js-builder` / `core-js-bundle` output. That mean that if the output contains, for example, `es.object.has-own`, the legacy shortcut to it, `esnext.object.has-own`, will not be added. - Fixed work of non-standard V8 `Error` features with wrapped `Error` constructors, [#1061](https://github.com/zloirock/core-js/issues/1061) - `null` and `undefined` allowed as the second argument of `structuredClone`, [#1056](https://github.com/zloirock/core-js/issues/1056) diff --git a/packages/core-js/internals/array-to-spliced.js b/packages/core-js/internals/array-to-spliced.js index 5eec407af71e..b1df3edcc034 100644 --- a/packages/core-js/internals/array-to-spliced.js +++ b/packages/core-js/internals/array-to-spliced.js @@ -2,8 +2,10 @@ var lengthOfArrayLike = require('../internals/length-of-array-like'); var toAbsoluteIndex = require('../internals/to-absolute-index'); var toIntegerOrInfinity = require('../internals/to-integer-or-infinity'); +var $TypeError = TypeError; var max = Math.max; var min = Math.min; +var MAX_SAFE_INTEGER = 0x1FFFFFFFFFFFFF; // https://tc39.es/proposal-change-array-by-copy/#sec-array.prototype.toSpliced // https://tc39.es/proposal-change-array-by-copy/#sec-%typedarray%.prototype.toSpliced @@ -25,6 +27,7 @@ module.exports = function (O, C, args) { actualDeleteCount = min(max(toIntegerOrInfinity(deleteCount), 0), len - actualStart); } newLen = len + insertCount - actualDeleteCount; + if (newLen > MAX_SAFE_INTEGER) throw $TypeError('Maximum allowed length exceeded'); A = new C(newLen); for (; k < actualStart; k++) A[k] = O[k];