2.1.69 [ECMA-262-1999] Section 15.4.4.7, Array.prototype.push ( [ item1 [ , item2 [ , … ] ] ] )

  • Article

V0105:

The arguments are appended to the end of the array, in the order in which they appear. The new length of the array is returned as the result of the call.

When the push method is called with zero or more arguments item1, item2, etc., the following steps are taken:

(The bulleted steps are added before step 1)

  • __Let O be the result of calling ToObject with the this value as the argument.__

  • __If O is a host object, throw a TypeError exception.__

  • __If JScript 5.7 and if false is the result of calling the [[HasProperty]] method of O with name "length", return undefined.__

  1. Call the [[Get]] method of __O__ #this object# with argument "length".

  2. Let n be the result of calling ToUint32(Result(1)).

  3. Get the next argument in the argument list; if there are no more arguments, go to step 7.

    1. __If JScript.X under Internet Explorer 9 and n < 2147483648 then let indx be n; else throw a RangeError exception.__

    2. __If JScript.X under Internet Explorer 7 or 8 and n < 2147483648 then let indx be n; else let indx be n-4294967296.__

  4. Call the [[Put]] method of __O__ #this object# with arguments ToString(__indx__ #n#) and Result(3).

  5. Increase n by 1.

  6. Go to step 3.

  7. Call the [[Put]] method of __O__ #this object# with arguments "length" and n.

  8. __If JScript.X under Internet Explorer 9, return__ #Return# n.

  9. __If JScript.X under Internet Explorer 7 or 8 and n < 2147483648 return n; else return n-4294967296.__

JScript 5.x under Internet Explorer 7 or 8 does not conform to the base specification in situations where the initial value of the array's length property after conversion using ToUint32 is greater than 2147483647 (which is 231-1) or where the push method's base specification operation would cause the array's length to exceed that value. In such situations, any array elements that would have been created with indices greater than 2147483647 are instead created with properties names that are the string representation of the negative integer that is the 32-bit 2's complement interpretation of 32-bit encoding of the index value. The length property is adjusted normally in conformance to the base specification; however, if the final length value is greater than 2147483647, the return value is the negative integer that is the 32-bit 2's complement interpretation of 32-bit encoding of the final length value.