mozilla/rhino — pull request #71 by anba (2012-07-28 12:57:39+00:00)
Title: Patch for Bug 778421

`Array.prototype.sort` performed an unchecked cast from long to int without any overflow checks, this may result in a negative length which then throws a NegativeArraySizeException in Java, cf. js1_5/Array/regress-157652.js . A similar problem was found in NativeJSON, so I've handled that as well