ToLength suffers from off-by-one errors

[gibson042]

(found when working through semantics for #2501)

ToLength is described as returning a value "suitable for use as the length of an array-like object", but its algorithm clamps that to 2⁵³ - 1, which is the maximum possible value of an integer index and therefore one less than the maximum possible length of an array-like object. And some uses of it correspond with the description (LengthOfArrayLike and StringPad), while others correspond with the algorithm (ToIndex and RegExp retrieval of lastIndex).

ToIndex itself seems to have a similar problem, with TypedArray and ArrayBuffer and SharedArrayBuffer and InitializeTypedArrayFromArrayBuffer using its output as a length.

I believe this concern does not yet manifest in practice due to the extremely large values in question, but it should still be addressed.

[bathos]

Isn't the max integer index 2⁵³ - 2?

(Nm, I see it's ≤ there. Only for array indexes is the offset - 2)

[claudepache]

Be careful that, in several cases, it is perfectly reasonable to have an “index” that is equal to the “length” of the corresponding string/array. This is the case for RegExp#lastIndex (where it means that the end of the string has been attained), or of Array#slice. (In fact, in those two examples, the “index” is better viewed as a position between two consecutive items, where 0 means “just before the first item” and length means “just after the last item”.)

[gibson042]

That's a good point, but I think issues with lastIndex and slice are avoided by the maximum length of Strings and Arrays both being less than the maximum length of array-like objects. Maybe the fix is just to leave ToLength as it is and reduce the maximum value of integer index by one (to 2⁵³ - 2), updating ToIndex accordingly—and preserving the weirdness of Integer-Indexed exotic objects subjecting "9007199254740992" and other decimal representations of large numbers having exact Number values to the same special treatment as an integer index even though they cannot ever be a valid index.