diff --git a/js2/src/js2array.cpp b/js2/src/js2array.cpp
index c49c99d56e32..f49741d09192 100644
--- a/js2/src/js2array.cpp
+++ b/js2/src/js2array.cpp
@@ -519,7 +519,7 @@ static void js_qsort(js2val *vec, size_t nel, CompareArgs *arg)
     js2val *pivot;
     QSortArgs qa;
 
-    pivot = (js2val *)STD::malloc(nel);
+    pivot = (js2val *)STD::malloc(nel * sizeof(js2val));
     qa.vec = vec;
     qa.pivot = pivot;
     qa.arg = arg;
diff --git a/js2/src/js2engine.cpp b/js2/src/js2engine.cpp
index 45a770ea9d95..440f22eec7cb 100644
--- a/js2/src/js2engine.cpp
+++ b/js2/src/js2engine.cpp
@@ -328,6 +328,13 @@ namespace MetaData {
         const char *chrp = doubleToStr(buf, dtosStandardBufferSize, i, dtosStandard, 0);
         return allocStringPtr(chrp);
     }
+    // Convert an integer to a string
+    String *JS2Engine::numberToString(uint32 i)
+    {
+        char buf[dtosStandardBufferSize];
+        const char *chrp = doubleToStr(buf, dtosStandardBufferSize, i, dtosStandard, 0);
+        return allocStringPtr(chrp);
+    }
 
     // Convert a double to a string
     String *JS2Engine::numberToString(float64 *number)
diff --git a/js2/src/js2engine.h b/js2/src/js2engine.h
index b3cfadade81e..ebe7c70edc6e 100644
--- a/js2/src/js2engine.h
+++ b/js2/src/js2engine.h
@@ -253,6 +253,7 @@ public:
 
     String *numberToString(float64 *number);    // non-static since they need access to meta
     String *numberToString(int32 i);
+    String *numberToString(uint32 i);
 
     js2val allocFloat(float32 x); 
     js2val pushFloat(float32 x)         { js2val retval = allocFloat(x); push(retval); return retval; }
diff --git a/js2/src/js2op_literal.cpp b/js2/src/js2op_literal.cpp
index cc7d13212096..1ee7880e4c57 100644
--- a/js2/src/js2op_literal.cpp
+++ b/js2/src/js2op_literal.cpp
@@ -200,7 +200,7 @@ makeLimitedInstance:
             baseVal = OBJECT_TO_JS2VAL(aInst);
             for (uint16 i = 0; i < argCount; i++) {
                 b = pop();
-                meta->createDynamicProperty(aInst, numberToString((argCount - 1) - i), b, ReadWriteAccess, false, true);
+                meta->createDynamicProperty(aInst, numberToString(toUInt32((argCount - 1) - i)), b, ReadWriteAccess, false, true);
             }
             setLength(meta, aInst, argCount);
             push(baseVal);
diff --git a/js2/src/js2regexp.cpp b/js2/src/js2regexp.cpp
index f7b5389118db..b78f00d1828e 100644
--- a/js2/src/js2regexp.cpp
+++ b/js2/src/js2regexp.cpp
@@ -214,7 +214,7 @@ namespace MetaData {
                 if (match->parens[i].index != -1) {
                     parenStr = meta->engine->allocString(str->substr((uint32)(match->parens[i].index), (uint32)(match->parens[i].length)));
                     if (!test)
-						meta->createDynamicProperty(A, meta->engine->numberToString(i + 1), parenStr, ReadWriteAccess, false, true);
+						meta->createDynamicProperty(A, meta->engine->numberToString(toUInt32(i + 1)), parenStr, ReadWriteAccess, false, true);
 					if (i < 9) { // 0-->8 maps to $1 thru $9
 						char name[3] = "$0";
 						name[1] = '1' + i;
@@ -224,7 +224,7 @@ namespace MetaData {
 				}
 				else {
 					if (!test)
-						meta->createDynamicProperty(A, meta->engine->numberToString(i + 1), JS2VAL_UNDEFINED, ReadWriteAccess, false, true);
+						meta->createDynamicProperty(A, meta->engine->numberToString(toUInt32(i + 1)), JS2VAL_UNDEFINED, ReadWriteAccess, false, true);
 					if (i < 9) { // 0-->8 maps to $1 thru $9
 						char name[3] = "$0";
 						name[1] = '1' + i;