Skip to content

Instantly share code, notes, and snippets.

@dherman

dherman/range-error-ftw.js

Created November 27, 2012 22:53
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dherman/4157754 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dherman/4157754 to your computer and use it in GitHub Desktop.
Download ZIP
fun with JS arrays
Raw
range-error-ftw.js
var a = [];
a[Math.pow(2, 32) - 2] = "max index"; // highest non-expando indexed property
console.log(a.length === Math.pow(2, 32) - 1); // true
try {
a.push("whoa", "EVEN MOAR WHOA");
} catch (e) {
console.log(e instanceof RangeError); // true
}
console.log(a.length === Math.pow(2, 32) - 1); // true
console.log(a[Math.pow(2, 32) - 1] === "whoa"); // true
console.log(a[Math.pow(2, 32)] === "EVEN MOAR WHOA"); // true
@floriancargoet
Copy link
Copy Markdown

floriancargoet commented Nov 28, 2012

Another weird thing: invoking an unknown method on this "full" array crashes the tab in Chromium (25) instead of throwing a TypeError

var a = [];
a[Math.pow(2, 32) - 2] = "max index";
a.crashMyTab(); // "Aw, Snap! Something went wrong…" message

@erikcorry
Copy link
Copy Markdown

erikcorry commented Nov 28, 2012

It's an out of memory error. The attempt to format the exception string means you call 'toString' on the array, but the string representation is around 2 billion commas which isn't going to work. I filed http://code.google.com/p/v8/issues/detail?id=2431 for you

@erikcorry
Copy link
Copy Markdown

erikcorry commented Nov 28, 2012

As for the initial comment, see https://bugs.ecmascript.org/show_bug.cgi?id=131

@floriancargoet
Copy link
Copy Markdown

floriancargoet commented Dec 7, 2012

@erikcorry Thank you for the bug report, I should have done that immediately.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment