ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/array-iterator.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $arrayValues;
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
 // -----------------------------------------------------------------------
 // Imports
 
 var arrayIterationKindSymbol =
     utils.GetPrivateSymbol("array_iteration_kind_symbol");
 var arrayIteratorNextIndexSymbol =
     utils.GetPrivateSymbol("array_iterator_next_symbol");
 var arrayIteratorObjectSymbol =
     utils.GetPrivateSymbol("array_iterator_object_symbol");
 var GlobalArray = global.Array;
+var ToLengthFlagged;
+
+utils.Import(function(from) {
+  ToLengthFlagged = from.ToLengthFlagged;
+});
+
 
 macro TYPED_ARRAYS(FUNCTION)
   FUNCTION(Uint8Array)
   FUNCTION(Int8Array)
   FUNCTION(Uint16Array)
   FUNCTION(Int16Array)
   FUNCTION(Uint32Array)
   FUNCTION(Int32Array)
   FUNCTION(Float32Array)
   FUNCTION(Float64Array)
@@ skipping 48 matching lines @@
                         'Array Iterator.prototype.next', this);
   }
 
   var array = GET_PRIVATE(iterator, arrayIteratorObjectSymbol);
   if (IS_UNDEFINED(array)) {
     return CreateIteratorResultObject(UNDEFINED, true);
   }
 
   var index = GET_PRIVATE(iterator, arrayIteratorNextIndexSymbol);
   var itemKind = GET_PRIVATE(iterator, arrayIterationKindSymbol);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
 
   // "sparse" is never used.
 
   if (index >= length) {
     SET_PRIVATE(iterator, arrayIteratorObjectSymbol, UNDEFINED);
     return CreateIteratorResultObject(UNDEFINED, true);
   }
 
   SET_PRIVATE(iterator, arrayIteratorNextIndexSymbol, index + 1);
 
@@ skipping 64 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayIteratorCreateResultObject = CreateIteratorResultObject;
 });
 
 $arrayValues = ArrayValues;
 
 %InstallToContext(["array_values_iterator", ArrayValues]);
 
 })