Microsoft Edge - 'Array.reverse' Overflow

left = uint32length - seg-left + seg-length; Can become a very large value as length is larger than seg-length and seg-left is generally 0. This can cause the segment length to become larger than the segment size the next time SparseArraySegmentBase::EnsureSizeInBound is called, as the method...