.toSpliced should throw a TypeError instead of RangeError

tc39/proposal-change-array-by-copy#70

src/Float16Array.mjs

@@ -17,6 +17,7 @@ import {
   CANNOT_MIX_BIGINT_AND_OTHER_TYPES,
   DERIVED_CONSTRUCTOR_CREATED_TYPEDARRAY_OBJECT_WHICH_WAS_TOO_SMALL_LENGTH,
   ITERATOR_PROPERTY_IS_NOT_CALLABLE,
+  MAXIMUM_ALLOWED_LENGTH_EXCEEDED,
   OFFSET_IS_OUT_OF_BOUNDS,
   REDUCE_OF_EMPTY_ARRAY_WITH_NO_INITIAL_VALUE,
   SPECIES_CONSTRUCTOR_DIDNT_RETURN_TYPEDARRAY_OBJECT,
@@ -38,6 +39,7 @@ import {
   NativeWeakMap,
   NativeWeakSet,
   NumberIsNaN,
+  NumberMAX_SAFE_INTEGER,
   ObjectDefineProperty,
   ObjectFreeze,
   ObjectHasOwn,
@@ -1067,6 +1069,9 @@ export class Float16Array {
 
     // don't use SpeciesConstructor
     const newLength = length + insertCount - actualDeleteCount;
+    if (newLength > NumberMAX_SAFE_INTEGER) {
+      throw NativeTypeError(MAXIMUM_ALLOWED_LENGTH_EXCEEDED);
+    }
     const proxy = new Float16Array(newLength);
     const array = getFloat16BitsArray(proxy);
 

src/_util/messages.mjs

@@ -19,4 +19,5 @@ export const CANNOT_MIX_BIGINT_AND_OTHER_TYPES =
 export const ITERATOR_PROPERTY_IS_NOT_CALLABLE = "@@iterator property is not callable";
 export const REDUCE_OF_EMPTY_ARRAY_WITH_NO_INITIAL_VALUE =
   "Reduce of empty array with no initial value";
+export const MAXIMUM_ALLOWED_LENGTH_EXCEEDED = "Maximum allowed length exceeded";
 export const OFFSET_IS_OUT_OF_BOUNDS = "Offset is out of bounds";

src/_util/primordials.mjs

@@ -42,6 +42,7 @@ export const NativeNumber = Number;
 export const {
   isFinite: NumberIsFinite,
   isNaN: NumberIsNaN,
+  MAX_SAFE_INTEGER: NumberMAX_SAFE_INTEGER,
 } = NativeNumber;
 
 // Symbol