fun with JS arrays

range-error-ftw.js

var a = [];

a[Math.pow(2, 32) - 2] = "max index";                 // highest non-expando indexed property
console.log(a.length === Math.pow(2, 32) - 1);        // true

try {
    a.push("whoa", "EVEN MOAR WHOA");
} catch (e) {
    console.log(e instanceof RangeError);             // true
}
console.log(a.length === Math.pow(2, 32) - 1);        // true
console.log(a[Math.pow(2, 32) - 1] === "whoa");       // true
console.log(a[Math.pow(2, 32)] === "EVEN MOAR WHOA"); // true

Another weird thing: invoking an unknown method on this "full" array crashes the tab in Chromium (25) instead of throwing a TypeError

var a = [];
a[Math.pow(2, 32) - 2] = "max index";
a.crashMyTab(); // "Aw, Snap! Something went wrong…" message

It's an out of memory error. The attempt to format the exception string means you call 'toString' on the array, but the string representation is around 2 billion commas which isn't going to work. I filed http://code.google.com/p/v8/issues/detail?id=2431 for you

As for the initial comment, see https://bugs.ecmascript.org/show_bug.cgi?id=131

@erikcorry Thank you for the bug report, I should have done that immediately.