1792151 - Reject creating tuple from array with indexed properties

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[André Bargull [:anba]]

var list = new Int32Array(1 << 28);
list[Symbol.iterator] = null;

// Probably takes some time. :-)
var tuple = Tuple.from(list);

assertEq(tuple.length, list.length);

Expected: No error thrown.
Actual: Throws Assertion failed: got 268435453, expected 268435456.

Note: 268435453 is MAX_DENSE_ELEMENTS_COUNT.

ArrayToTuple should probably have these extra checks:

• NativeObject::isIndexed() should be false.
• IsPackedArray() should be true.