2.1.162 [ECMA-262-1999] Section B.2.3, String.prototype.substr (start, length)
The substr method takes two arguments, start and length, and returns a substring of the result of converting this object to a string, starting from character position start and running for length characters (or through the end of the string is length is undefined). If start is negative, it is treated as __zero__ #(sourceLength+start) where sourceLength is the length of the string#. The result is a string value, not a String object.
Call ToString, giving it the this value as its argument.
If length is undefined, use +∞; otherwise call ToInteger(length).
Compute the number of characters in Result(1).
If Result(2) is positive or zero, use Result(2); else use __zero__ #max(Result(4)+Result(2),0)#.
Compute min(max(Result(3),0), Result(4)-Result(5)).
If Result(6) ≤ 0, return the empty string "".
Return a string containing Result(6) consecutive characters from Result(1) beginning with the character at position Result(5).
The length property of the substr method is 2.