joyent/node — pull request #7753 by yorkie (2014-06-08 09:17:32+00:00)
Title: buffer: fix abort while passing incorrect this in slice

Reproduce code:
```js
var b = new Buffer(512);
var c = 'foo';
b.slice.apply(c, [0, 128]);
```
The node process aborted at https://github.com/joyent/node/blob/master/src/smalloc.cc#L258 and prints:
```sh
Assertion failed: (source->HasIndexedPropertiesInExternalArrayData()), function SliceOnto, file ../src/smalloc.cc, line 312.
Abort trap: 6
```

We should protect this by doing a check for `buf.slice`, and the reproduced version is 0.11.13.