In the algorithm of Function.prototype.bind, the computation the length of the bound function being constructed is performed by steps 5 and 6, which read:
5. If Target has a [[BoundTargetFunction]] internal slot, then
a. Let targetLen be the result of Get(Target, "length").
b. ReturnIfAbrupt(targetLen).
c. Let L be the larger of 0 and the result of targetLen minus the number of elements of A.
6. Else let L be 0.
There are two issues:
First, it is not clear why step 5 apparently restricts its scope to bound functions. It seems more reasonable to restrict to any function (as in ES5.1). (I may have missed issues with proxies, however.)
Second, there is an implicit assumption that getting the value of the "length" property of `Target` will produce a number. It is no longer true since the "length" property of non-builtin functions is configurable (even under the current restriction of step 5). Therefore, the value of `targetLen` should be coerced to a nonnegative integer before its use in step 5c.
fixed in rev26 editor's draft
fixed in rev26