Fix assertion failure in JavascriptArray.cpp

lib/Runtime/Library/JavascriptArray.cpp

@@ -9402,9 +9402,8 @@ using namespace Js;
         }
         else
         {
-            Assert(fromVal < MaxArrayLength);
-            Assert(toVal < MaxArrayLength);
-            Assert(direction == -1 || (fromVal + count < MaxArrayLength && toVal + count < MaxArrayLength));
+            Assert(direction != -1 || (fromVal < MaxArrayLength && toVal < MaxArrayLength));
+            Assert(fromVal + count <= MaxArrayLength && toVal + count <= MaxArrayLength);
 
             uint32 fromIndex = static_cast<uint32>(fromVal);
             uint32 toIndex = static_cast<uint32>(toVal);

test/es6/ES6ArrayAPI_slow.js

@@ -0,0 +1,20 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) ChakraCore Project Contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+WScript.LoadScriptFile("..\\UnitTestFramework\\UnitTestFramework.js");
+
+const uint32Max = 4294967295;
+const tests = [
+    {
+        name: "Issue #6770 (Assertion failure in copyWithin)",
+        body() {
+            const array = [];
+            array.length = uint32Max;
+            array.copyWithin();
+        }
+    }
+];
+testRunner.runTests(tests, { verbose: WScript.Arguments[0] != "summary" });

test/es6/rlexe.xml

@@ -466,6 +466,13 @@
       <compile-flags>-ES6ObjectLiterals -args summary -endargs</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>ES6ArrayAPI_slow.js</files>
+      <compile-flags>-ES6ObjectLiterals -args summary -endargs</compile-flags>
+      <tags>Slow</tags>
+    </default>
+  </test>
   <test>
     <default>
       <files>ES6ArrayUseConstructor.js</files>