Finiteness of object properties set
brendan at mozilla.com
Tue Sep 20 13:33:50 PDT 2011
On Sep 19, 2011, at 4:04 AM, David Bruant wrote:
> Object.getOwnPropertyDescriptor creates a native array and, for each own property, it calls [[DefineOwnProperty]] on this array for an index n (ES5.1 - 220.127.116.11 step 4.b)
> This internal method is special for arrays (ES5.1 - 18.104.22.168). When crossing 2³², ToString(n) is not an array index anymore, so the property is added (as per step 5), but the length property gets stuck to its maximum (2³²).
> Since the property is added, continuing results in an infinite loop, the length property remains at 2³².
Nit-pick: length stops at (2³² - 1). Maximum value of the corresponding index is therefore (2³² - 2).
I wish we hadn't codified this in ES1. Oh well.
More information about the es-discuss