22.1.3.3 Array.prototype.copyWithin (target, start, end = this.length), step 6:
- len is never negative (ToLength!), so `max(len, 0)` is unnecessary
22.2.1.1 %TypedArray% ( length ), step 13:
- elementLength is never negative (ToLength!), so `elementLength < 0` is always false
22.2.1.3 %TypedArray % ( array ), step 13:
- elementLength is never negative (ToLength!), so `elementLength < 0` is always false
22.2.1.4 %TypedArray% ( buffer, byteOffset=0, length=undefined ), step 18c:
- newLength is never negative (ToLength!), so `newLength < 0` is always false
24.1.2.1 ArrayBuffer(length), step 6:
- byteLength is never negative (ToLength!), so SameValue(numberLength, byteLength) already covers the negative values check, that means the path `numberLength < 0` is never taken
fixed in rev21 editor's draft
fixed in rev21 draft