diff --git a/lib/buffer.js b/lib/buffer.js
index 4a69db6..cfd976b 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -432,63 +432,27 @@ Object.defineProperty(Buffer.prototype, 'offset', {
 });
 
 
-function slowToString(encoding, start, end) {
+function slowToString(buf, encoding, start, end) {
   var loweredCase = false;
-
-  // No need to verify that "this.length <= MAX_UINT32" since it's a read-only
-  // property of a typed array.
-
-  // This behaves neither like String nor Uint8Array in that we set start/end
-  // to their upper/lower bounds if the value passed is out of range.
-  // undefined is handled specially as per ECMA-262 6th Edition,
-  // Section 13.3.3.7 Runtime Semantics: KeyedBindingInitialization.
-  if (start === undefined || start < 0)
-    start = 0;
-  // Return early if start > this.length. Done here to prevent potential uint32
-  // coercion fail below.
-  if (start > this.length)
-    return '';
-
-  if (end === undefined || end > this.length)
-    end = this.length;
-
-  if (end <= 0)
-    return '';
-
-  // Force coersion to uint32. This will also coerce falsey/NaN values to 0.
-  end >>>= 0;
-  start >>>= 0;
-
-  if (end <= start)
-    return '';
-
-  if (!encoding) encoding = 'utf8';
-
   while (true) {
     switch (encoding) {
-      case 'hex':
-        return this.hexSlice(start, end);
-
       case 'utf8':
       case 'utf-8':
-        return this.utf8Slice(start, end);
-
+        return buf.utf8Slice(start, end);
+      case 'hex':
+        return buf.hexSlice(start, end);
       case 'ascii':
-        return this.asciiSlice(start, end);
-
+        return buf.asciiSlice(start, end);
       case 'latin1':
       case 'binary':
-        return this.latin1Slice(start, end);
-
+        return buf.latin1Slice(start, end);
       case 'base64':
-        return this.base64Slice(start, end);
-
+        return buf.base64Slice(start, end);
       case 'ucs2':
       case 'ucs-2':
       case 'utf16le':
       case 'utf-16le':
-        return this.ucs2Slice(start, end);
-
+        return buf.ucs2Slice(start, end);
       default:
         if (loweredCase)
           throw new TypeError('Unknown encoding: ' + encoding);
@@ -498,19 +462,47 @@ function slowToString(encoding, start, end) {
   }
 }
 
-Buffer.prototype.copy = function(target, targetStart, sourceStart, sourceEnd) {
-  return binding.copy(this, target, targetStart, sourceStart, sourceEnd);
-};
-
-
+// When comparing `start` and `end` with `buffer.length`, there is no need to
+// verify that "this.length <= MAX_UINT32" since it's a read-only property of a
+// typed array.
+// The bounds checking performed by `toString()` behaves neither like String nor
+// Uint8Array in that we set start/end to their upper/lower bounds if the value
+// passed is out of range.
+// `undefined` is handled specially as per ECMA-262 6th Edition,
+// Section 13.3.3.7 Runtime Semantics: KeyedBindingInitialization.
+// Additionally, we return early if `start > this.length`. This is done to
+// prevent potential uint32 coercion failures.
 Buffer.prototype.toString = function(encoding, start, end) {
-  const result = slowToString.call(this, encoding, start, end);
+  if (start === undefined || start < 0)
+    start = 0;
+  else if (start > this.length)
+    return '';
+  else
+    start >>>= 0;
+  if (end === undefined || end > this.length)
+    end = this.length;
+  else if (end <= 0)
+    return '';
+  else
+    end >>>= 0;
+  if (end <= start)
+    return '';
+  var result;
+  if (!encoding)
+    result = this.utf8Slice(start, end);
+  else
+    result = slowToString(this, encoding, start, end);
   if (result === undefined)
     throw new Error('"toString()" failed');
   return result;
 };
 
 
+Buffer.prototype.copy = function(target, targetStart, sourceStart, sourceEnd) {
+  return binding.copy(this, target, targetStart, sourceStart, sourceEnd);
+};
+
+
 Buffer.prototype.equals = function equals(b) {
   if (!isUint8Array(b))
     throw new TypeError('Argument must be a Buffer or Uint8Array');