Fix limit calculation in String.prototype.split

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index 3ddd6d26cedfd9e49a5e624e071f0caeb005fba7..9a19258dd69388318e3e2686b8ed3b305277f6dd 100644
--- a/src/string.js
+++ b/src/string.js
@@ -10,6 +10,7 @@
 // Imports
 
 var GlobalRegExp = global.RegExp;
+var GlobalNumber = global.Number;
 var GlobalString = global.String;
 var InternalArray = utils.InternalArray;
 var InternalPackedArray = utils.InternalPackedArray;
@@ -608,7 +609,8 @@ function StringSplitJS(separator, limit) {
   CHECK_OBJECT_COERCIBLE(this, "String.prototype.split");
 
   var subject = TO_STRING_INLINE(this);
-  limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
+  limit = IS_UNDEFINED(limit) ? GlobalNumber.MAX_SAFE_INTEGER

[Dan Ehrenberg, 2015/07/13 23:19:13]

Defined this way, a user could modify Number.MAX_SAFE_INTEGER and change the
behavior of String.prototype.split, which violates the spec. Instead, you can
copy that value into another variable, so that it's evaluated at bootstrap time
before a user messes everything up.

[adamk, 2015/07/14 00:16:48]

MAX_SAFE_INTEGER is non-configurable, non-writable, and GlobalNumber is
guaranteed to the be the Number constructor at bootup time, so I think this is
actually safe.

+                              : $toLength(limit);
 
   var length = subject.length;
   if (!IS_REGEXP(separator)) {