IronJS icon indicating copy to clipboard operation
IronJS copied to clipboard

Transferring Array.prototype.slice to a non-array object and slicing on indexes larger then Int32.MaxValue returns invalid results

Open fholm opened this issue 14 years ago • 0 comments

When using Array.prototype.slice on a non-array object and slicing on values larger then Int32.MaxValue an invalid result is returned, example:

var obj = {};
obj.slice = Array.prototype.slice;
obj[4294967294] = "x";
obj.length = -1;
var arr = obj.slice(4294967294,4294967295);

fholm avatar Apr 10 '11 19:04 fholm