Fix limit calculation in String.prototype.split

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
 var GlobalRegExp = global.RegExp;
+var GlobalNumber = global.Number;
 var GlobalString = global.String;
 var InternalArray = utils.InternalArray;
 var InternalPackedArray = utils.InternalPackedArray;
 
 var ArrayIndexOf;
 var ArrayJoin;
 var MathMax;
 var MathMin;
 var RegExpExec;
 var RegExpExecNoTests;
@@ skipping 578 matching lines @@
 
   return %_SubString(s, start_i, end_i);
 }
 
 
 // ECMA-262 section 15.5.4.14
 function StringSplitJS(separator, limit) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.split");
 
   var subject = TO_STRING_INLINE(this);
-  limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
+  limit = IS_UNDEFINED(limit) ? GlobalNumber.MAX_SAFE_INTEGER

[Dan Ehrenberg, 2015/07/13 23:19:13]

Defined this way, a user could modify Number.MAX_SAFE_INTEGER and change the
behavior of String.prototype.split, which violates the spec. Instead, you can
copy that value into another variable, so that it's evaluated at bootstrap time
before a user messes everything up.

[adamk, 2015/07/14 00:16:48]

MAX_SAFE_INTEGER is non-configurable, non-writable, and GlobalNumber is
guaranteed to the be the Number constructor at bootup time, so I think this is
actually safe.

+                              : $toLength(limit);
 
   var length = subject.length;
   if (!IS_REGEXP(separator)) {
     var separator_string = TO_STRING_INLINE(separator);
 
     if (limit === 0) return [];
 
     // ECMA-262 says that if separator is undefined, the result should
     // be an array of size 1 containing the entire string.
     if (IS_UNDEFINED(separator)) return [subject];
@@ skipping 576 matching lines @@
   to.StringIndexOf = StringIndexOfJS;
   to.StringLastIndexOf = StringLastIndexOfJS;
   to.StringMatch = StringMatchJS;
   to.StringReplace = StringReplace;
   to.StringSplit = StringSplitJS;
   to.StringSubstr = StringSubstr;
   to.StringSubstring = StringSubstring;
 });
 
 })