.toSpliced should throw a TypeError instead of RangeError in th…

…e result length is more than `MAX_SAFE_INTEGER`

tc39/proposal-change-array-by-copy#59 (comment)

tc39/proposal-change-array-by-copy#70

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Changelog
 ##### Unreleased
 - [Change `Array` by copy proposal](https://github.com/tc39/proposal-change-array-by-copy) moved to stage 3
+- `Array.prototype.toSpliced` throws a `TypeError` instead of `RangeError` in the result length is more than `MAX_SAFE_INTEGER`, [proposal-change-array-by-copy/70](https://github.com/tc39/proposal-change-array-by-copy/pull/70)
 - Stabilized proposals are filtered out from the `core-js-compat` / `core-js-builder` / `core-js-bundle` output. That mean that if the output contains, for example, `es.object.has-own`, the legacy shortcut to it, `esnext.object.has-own`, will not be added.
 - Fixed work of non-standard V8 `Error` features with wrapped `Error` constructors, [#1061](https://github.com/zloirock/core-js/issues/1061)
 - `null` and `undefined` allowed as the second argument of `structuredClone`, [#1056](https://github.com/zloirock/core-js/issues/1056)

packages/core-js/internals/array-to-spliced.js

@@ -2,8 +2,10 @@ var lengthOfArrayLike = require('../internals/length-of-array-like');
 var toAbsoluteIndex = require('../internals/to-absolute-index');
 var toIntegerOrInfinity = require('../internals/to-integer-or-infinity');
 
+var $TypeError = TypeError;
 var max = Math.max;
 var min = Math.min;
+var MAX_SAFE_INTEGER = 0x1FFFFFFFFFFFFF;
 
 // https://tc39.es/proposal-change-array-by-copy/#sec-array.prototype.toSpliced
 // https://tc39.es/proposal-change-array-by-copy/#sec-%typedarray%.prototype.toSpliced
@@ -25,6 +27,7 @@ module.exports = function (O, C, args) {
     actualDeleteCount = min(max(toIntegerOrInfinity(deleteCount), 0), len - actualStart);
   }
   newLen = len + insertCount - actualDeleteCount;
+  if (newLen > MAX_SAFE_INTEGER) throw $TypeError('Maximum allowed length exceeded');
   A = new C(newLen);
 
   for (; k < actualStart; k++) A[k] = O[k];