JavaScript array problem affecting bugzilla

[Harri Porten]

On Mon, 19 Jul 2004, John Sullivan wrote:

> FYI, we were getting a NAN value that was being converted to some huge
> negative value by toInteger(), causing the subsequent loop to run for
> an extremely long time.

Hmm. Okay. Although I don't understand how this can happen as the value is
made fit into the range [0; length] in your code, too, no? Is the problem
related to the fact that you do the

  int b = static_cast<int>(begin);

after the bound check? What happens when the user specifies NaN
explicitly?

Harri.