From a7b141b8a607bb6922d837f9176520ba4fecb418 Mon Sep 17 00:00:00 2001
From: Denis Pushkarev <zloirock@zloirock.ru>
Date: Fri, 22 Dec 2023 08:07:26 +0700
Subject: [PATCH] it seems that the ancient `Array.prototype.push` bug is fixed
 in V8 ~ Chrome 122 (Hallelujah!)

https://bugs.chromium.org/p/v8/issues/detail?id=12681
---
 CHANGELOG.md                              | 1 +
 packages/core-js-compat/src/data.mjs      | 2 +-
 packages/core-js/modules/es.array.push.js | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1dc008e89808..5b1675cd9650 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 - Refactoring, some optimizations
 - Compat data improvements:
   - [`Array.fromAsync`](https://github.com/tc39/proposal-array-from-async) marked as [supported from V8 ~ Chrome 121](https://bugs.chromium.org/p/v8/issues/detail?id=13321#c13)
+  - It seems that the ancient [`Array.prototype.push` bug](https://bugs.chromium.org/p/v8/issues/detail?id=12681) is fixed in V8 ~ Chrome 122 (Hallelujah!)
   - [`ArrayBuffer.prototype.transfer` and friends proposal](https://github.com/tc39/proposal-arraybuffer-transfer) features marked as [supported from FF 122](https://bugzilla.mozilla.org/show_bug.cgi?id=1865103#c8)
   - Added Opera Android 80 and updated [Opera Android 79](https://forums.opera.com/topic/68490/opera-for-android-79) compat data mapping
   - Added Samsung Internet 24 compat data mapping
diff --git a/packages/core-js-compat/src/data.mjs b/packages/core-js-compat/src/data.mjs
index 5ce8f0704c43..a15c9322af8d 100644
--- a/packages/core-js-compat/src/data.mjs
+++ b/packages/core-js-compat/src/data.mjs
@@ -309,7 +309,7 @@ export const data = {
   },
   'es.array.push': {
     // bug with setting length
-    // chrome: '103',
+    chrome: '122', // chrome: '103',
     // edge: '15',
     firefox: '55',
     hermes: '0.2',
diff --git a/packages/core-js/modules/es.array.push.js b/packages/core-js/modules/es.array.push.js
index 61a9b914331e..71db9767d4db 100644
--- a/packages/core-js/modules/es.array.push.js
+++ b/packages/core-js/modules/es.array.push.js
@@ -10,7 +10,7 @@ var INCORRECT_TO_LENGTH = fails(function () {
   return [].push.call({ length: 0x100000000 }, 1) !== 4294967297;
 });
 
-// V8 and Safari <= 15.4, FF < 23 throws InternalError
+// V8 <= 121 and Safari <= 15.4; FF < 23 throws InternalError
 // https://bugs.chromium.org/p/v8/issues/detail?id=12681
 var properErrorOnNonWritableLength = function () {
   try {