IronJS
IronJS copied to clipboard
Transferring Array.prototype.slice to a non-array object and slicing on indexes larger then Int32.MaxValue returns invalid results
When using Array.prototype.slice on a non-array object and slicing on values larger then Int32.MaxValue an invalid result is returned, example:
var obj = {};
obj.slice = Array.prototype.slice;
obj[4294967294] = "x";
obj.length = -1;
var arr = obj.slice(4294967294,4294967295);