Fixed bug in array filter and reduce functions.

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 60cf3f0c5270e6fca1f7856a73547add6bbab35c..e6c13d9547c5f114480706f46ebd2a6d3c2bdd69 100644
--- a/src/array.js
+++ b/src/array.js
@@ -999,7 +999,7 @@ function ArrayFilter(f, receiver) {
   }
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping.
-  var length = this.length;
+  var length = ToUint32(this.length);
   var result = [];
   var result_length = 0;
   for (var i = 0; i < length; i++) {
@@ -1236,7 +1236,7 @@ function ArrayReduce(callback, current) {
   }
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping.
-  var length = this.length;
+  var length = ToUint32(this.length);
   var i = 0;
 
   find_initial: if (%_ArgumentsLength() < 2) {
@@ -1268,7 +1268,7 @@ function ArrayReduceRight(callback, current) {
   if (!IS_FUNCTION(callback)) {
     throw MakeTypeError('called_non_callable', [callback]);
   }
-  var i = this.length - 1;
+  var i = ToUint32(this.length) - 1;
 
   find_initial: if (%_ArgumentsLength() < 2) {
     for (; i >= 0; i--) {