Assertion failure in JavascriptArray::FindHelper()

Hello, executing following code in ch 1.22.24(debug), an assertion will be thrown.

var buffer = new Int8Array(8);
var func = function (elem) {
    return elem;
};

i = 9007199254740992;
Object.defineProperty(buffer, 'length', { value: i });
Array.prototype.find.call(buffer, func);

output:

ASSERTION 2480: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\runtime\library\javascriptarray.cpp, line 8558) length <= UINT_MAX
 Failure: (length <= 0xffffffff)
FATAL ERROR: ch.exe failed due to exception code c0000420

9007199254740992 is larger than Math::MAX_SAFE_INTEGER, so ch modified the length to Math::MAX_SAFE_INTEGER(9007199254740991 or 0x1F FFFF FFFF FFFF). Although length is modified larger than buffer's size, there is an index checking in BaseTypedDirectGetItem(__in uint32 index), which gets the real size of buffer, so the bug will not cause OOB access.

ISec Lab. 2020.12.16