From 798f40e66a11817325a631509655b8a76a7f50e8 Mon Sep 17 00:00:00 2001
From: Kenta Moriuchi <moriken@kimamass.com>
Date: Sun, 17 Apr 2022 23:42:18 +0900
Subject: [PATCH] `.toSpliced` should throw a `TypeError` instead of
 `RangeError`

https://github.com/tc39/proposal-change-array-by-copy/pull/70
---
 src/Float16Array.mjs   | 5 +++++
 src/_util/messages.mjs | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/Float16Array.mjs b/src/Float16Array.mjs
index 3e68a5da..af048d4e 100644
--- a/src/Float16Array.mjs
+++ b/src/Float16Array.mjs
@@ -17,6 +17,7 @@ import {
   CANNOT_MIX_BIGINT_AND_OTHER_TYPES,
   DERIVED_CONSTRUCTOR_CREATED_TYPEDARRAY_OBJECT_WHICH_WAS_TOO_SMALL_LENGTH,
   ITERATOR_PROPERTY_IS_NOT_CALLABLE,
+  MAXIMUM_ALLOWED_LENGTH_EXCEEDED,
   OFFSET_IS_OUT_OF_BOUNDS,
   REDUCE_OF_EMPTY_ARRAY_WITH_NO_INITIAL_VALUE,
   SPECIES_CONSTRUCTOR_DIDNT_RETURN_TYPEDARRAY_OBJECT,
@@ -29,6 +30,7 @@ import {
   ArrayPrototypePush,
   ArrayPrototypeSlice,
   ArrayPrototypeToLocaleString,
+  MAX_SAFE_INTEGER,
   NativeArrayBuffer,
   NativeObject,
   NativeProxy,
@@ -1067,6 +1069,9 @@ export class Float16Array {
 
     // don't use SpeciesConstructor
     const newLength = length + insertCount - actualDeleteCount;
+    if (newLength > MAX_SAFE_INTEGER) {
+      throw NativeTypeError(MAXIMUM_ALLOWED_LENGTH_EXCEEDED);
+    }
     const proxy = new Float16Array(newLength);
     const array = getFloat16BitsArray(proxy);
 
diff --git a/src/_util/messages.mjs b/src/_util/messages.mjs
index 9786dd5c..831bd878 100644
--- a/src/_util/messages.mjs
+++ b/src/_util/messages.mjs
@@ -17,4 +17,5 @@ export const CANNOT_MIX_BIGINT_AND_OTHER_TYPES =
 export const ITERATOR_PROPERTY_IS_NOT_CALLABLE = "@@iterator property is not callable";
 export const REDUCE_OF_EMPTY_ARRAY_WITH_NO_INITIAL_VALUE =
   "Reduce of empty array with no initial value";
+export const MAXIMUM_ALLOWED_LENGTH_EXCEEDED = "Maximum allowed length exceeded";
 export const OFFSET_IS_OUT_OF_BOUNDS = "Offset is out of bounds";