Analysis on usage of push method in Javascript array

The example in this article describes the usage of push method in Javascript array. Share it with everyone for your reference, the details are as follows:

Look at the code below:

var o = {
  1:'a'
  ,2:'b'
  ,length:2
  ,push:Array.prototype.push
};
o.push('c');

Q:o What does the internal value look like now?

My first reaction was rejection. Why study the behavior of [Explanation Engine] under unreasonable situations? But this kind of inference is sometimes very attractive, so when I came back, I thought about it carefully and found that it is actually very simple.

For the push method, what I think of reflexively is the stack. [Classic Stack of Data Structure] The push and pop operations are based on the top pointer of the stack. The top pointer always points to the top of the stack, which means it will Automatically increases or decreases due to depressing the stack. In the array in JavaScript, this pointer is length. So in the above code, o.push('c') is o.2 = 'c' (of course o.2 cannot be accessed directly, this is just pseudo code), so the data in o after the code is executed is as follows:

{
  1:'a'
  ,2:'c'
  ,length:3 //push操作=>length+1
  ,push:Array.prototype.push
}

Additional explanation:

In JavaScript, everything is an object, and JavaScript objects are somewhat different from strongly typed objects. It can be understood that an achievement is a collection of key-value pairs. The array type is no exception. Its subscript access is key access (but its keys are all natural numbers). In the above example, the object literal assigned to a actually simulates an array (a subscript starting from 1 Array) - Of course, there are only some characteristics of arrays. For example, when a real array is accessed by key, it will perform an out-of-bounds check based on length.

As long as you know that the push position is based on length, the following seemingly strange phenomena are easy to understand:

//1.length不存在，引擎置为0
var o = {
  '1':'a'
  ,'2':'b'
  ,push:Array.prototype.push
};
o.push('c');//c {0:'c',1:'a',2:'b',...}
//2.length为负值，这是个有趣的问题，涉及到原码反码和补码【1】
var o = {
  '1':'a'
  ,'2':'b'
  ,length:-1
  ,push:Array.prototype.push
};
o.push('c');//c {1:'a',2:'b',4294967295:'c',length:4294967296,...}
//3.length为字符或对象
var o = {
  1:'a'
  ,2:'b'
  ,length:'A'
  ,push:Array.prototype.push
};
o.push('c');//c {0:'c',1:'a',2:'b',length:1,...}我还以为js解释器会把A转换成ASCII码来给length赋值呢，终于看到了javascript的自由还是有节操的

Numbers in computers are stored in two's complement format. In order to facilitate calculations, - The complement of 1 is the same as the complement of 4294967295. According to the semantics of length, here is the unsigned number

[-1] complement = 1111 1111 1111 1111 1111 1111 1111 1111 = [4294967295] complement = 1111 1111 1111 1111 1 111 1111 1111 1111

So in this way, we connect o in difference pair 2 and push into an object. The key is 4294967296, but the maximum length of the array is limited to 4294967296, which means that the subscript can only get 4294967295, and only 32 bits - —For 4294967296 = 1 0000 0000 0000 0000 0000 0000 0000 0000, the last 32 bits become 0, so the position of this push is 0.