Integer overflow to negative number

Question

According to this link, I learned that in IE8 the the new element's index will be a negative number if the array was created with an index greater than 2147483647.

And there is this sample :

function test() { 
    var arr = new Array();         
    arr[2147483650] = 10000; 
    arr.push(10);     
    document.write(arr["-2147483645"] == 10); 
} 
test();

What I don't understand is, how come the newly added element of the array have the index of -2147483645, I understand the negative part, I just don't know how to know that the new index is 2147483645, not -2147483644 or -2147483651 ...

Answer 1

When representing a number in 32 bits, the highest bit is used as a sign bit, so when representing a number like 2147483647 in binary, it is

01111...111

where there are 31 1's. When we add one more to that, we get

10000...000

where there are 31 0's. Thus we have tripped the sign bit to be one indicating a negative number. However, because of a need to avoid representing 0 twice, we wrap the number, so instead of representing -0, this represents negative 2147483648 (not 2147483647 because the positive side needed to represent 0, but as the negative side doesn't, we get one "extra" negative number).

Each time that we add one to this, it will increase the binary representation, which counts down through the negative numbers

1000...00 = -2147483648 // this is 2147483648
1000...01 = -2147483647 // this is 2147483649
1000...10 = -2147483646 // this is 2147483650

and so on. Thus 2147483650 gets wrapped to -2147483646 and therefore, one more than that gets set to -2147483645.

See here for more detail.