patch: hang when setting select.length to negative value

[Harri Porten]

On Mon, 17 Nov 2003, Maciej Stachowiak wrote:

> Setting of select.length wasn't checking the value very carefully,
> causing hangs on at least two sites:

Applied. Were a bit confused about the toUInt32() variant that I hadn't
discovered up to date :)

Thanks,

Harri.