Ob spec reference, http://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.copywithin step 12.
Which actually reminds me that I meant to file a spec bug here, since the non-normative text at top describes the default as being `this.length`, but the actual algorithm specifies the default as being effectively `ToLength(ToObject(this).length)`.  This is significant in the case that the length field is negative...