buffer: coerce extrema to int in blob.slice

PR-URL: #55141
Fixes: #55139
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

lib/internal/blob.js

@@ -54,6 +54,7 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
+const { convertToInt } = require('internal/webidl');
 
 const {
   codes: {
@@ -239,6 +240,12 @@ class Blob {
   slice(start = 0, end = this[kLength], contentType = '') {
     if (!isBlob(this))
       throw new ERR_INVALID_THIS('Blob');
+
+    // Coerce values to int
+    const opts = { __proto__: null, signed: true };
+    start = convertToInt('start', start, 64, opts);
+    end = convertToInt('end', end, 64, opts);
+
     if (start < 0) {
       start = MathMax(this[kLength] + start, 0);
     } else {

test/parallel/test-blob.js

@@ -483,6 +483,7 @@ assert.throws(() => new Blob({}), {
 
   assert.ok(blob.slice(0, 1).constructor === Blob);
   assert.ok(blob.slice(0, 1) instanceof Blob);
+  assert.ok(blob.slice(0, 1.5) instanceof Blob);
 }
 
 (async () => {