String slice() testcases are not passing. attached KJS patch fixes it. It should be fairly easy to merge by hand.
Created attachment 4394 [details] patch to fix slice() in KJS
Comment on attachment 4394 [details] patch to fix slice() in KJS George and I discussed how it would be safer against extreme values ot use toInteger and leave things as double until after the range check, but I think it's still an improvement to merge this fix from KJS.
Comment on attachment 4394 [details] patch to fix slice() in KJS The standard is clear on this point: toUInt32 is incorrect, toInteger is correct. But that's a bug that can be fixed separately.
Filed a new bug to track using toInteger: 5490.
Created attachment 4466 [details] Revised Patch Psych. Decided to fix it myself here. Also fixed the end == undefined case.
Comment on attachment 4466 [details] Revised Patch There are a few examples here of braces for single lines. That doesn't match our coding style. Also, I prefer just doing a return to setting the value of String. Finally, I'd like test cases for what you fixed here. But it looks good to me, so review+ anyway.
I removed the single braces and added a layout test for the cases not covered by the mozilla test suite before landing. I felt iffy about returning immediately rather than setting result, though. Setting result is the idiom for StringProtoFuncImp::callAsFunction. If we don't like that idiom, I think we should file a separate bug and change all cases of it in the function, rather than creating an idiosyncracy for this one case.