diff --git a/polyfill.js b/polyfill.js
index 68b3bc3..c48740c 100644
--- a/polyfill.js
+++ b/polyfill.js
@@ -204,6 +204,9 @@
             const o = toObject(this);
             const len = lengthOfArrayLike(o);
             const { actualStart, actualDeleteCount, newLen } = calculateSplice({ start, deleteCount, len, values, argsCount: arguments.length });
+            if (newLen > Number.MAX_SAFE_INTEGER) {
+                throw new TypeError();
+            }
             const a = new Array(newLen);
             doSplice({ src: o, target: a, actualStart, actualDeleteCount, values, newLen });
             return a;
diff --git a/spec.html b/spec.html
index c616ee9..dd478b4 100644
--- a/spec.html
+++ b/spec.html
@@ -86,6 +86,7 @@ <h1>Array.prototype.toSpliced ( _start_, _deleteCount_, ..._items_ )</h1>
                         1. Let _dc_ be ? ToIntegerOrInfinity(_deleteCount_).
                         1. Let _actualDeleteCount_ be the result of clamping _dc_ between 0 and _len_ - _actualStart_.
                     1. Let _newLen_ be _len_ + _insertCount_ - _actualDeleteCount_.
+                    1. If _newLen_ &gt; 2<sup>53</sup> - 1, throw a *TypeError* exception.
                     1. Let _A_ be ? ArrayCreate(𝔽(_newLen_)).
                     1. Let _k_ be 0.
                     1. Repeat, while _k_ &lt; _actualStart_,
diff --git a/test262 b/test262
index 222b15f..6c352b6 160000
--- a/test262
+++ b/test262
@@ -1 +1 @@
-Subproject commit 222b15ffd878adfaef8ca7db67c0906a083bbdb2
+Subproject commit 6c352b60b91a2b8a57048457f09d563d08e441c4