Assertion Failure in JavascriptArray

[daehee87]

Debug build of ChakraCore shows assertion failure from the following code

ChakraCore/lib/Runtime/Library/JavascriptArray.cpp, line 5779) length <= JavascriptArray::MaxArrayLength Failure: (length <= JavascriptArray::MaxArrayLength)

I think the boundary number check has some error.
This is the PoC.

var ua = new Uint32Array(0x10);
ua.__proto__ = new Array(0xffffffff);
++ua.length;
ua.reverse();

ChakraCore: Latest, Debug build
OS: Ubuntu 18.04.2
Arch: x86_64