ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/code-stubs.h"
@@ skipping 1796 matching lines @@
   Handle<JSObject> builtins(native_context()->builtins());
 
   Handle<HeapObject> flag(FLAG_harmony_unicode_regexps ? heap()->true_value()
                                                        : heap()->false_value());
   Runtime::SetObjectProperty(isolate(), builtins,
                              factory()->harmony_unicode_regexps_string(), flag,
                              STRICT).Assert();
 }
 
 
+void Genesis::InitializeGlobal_harmony_tolength() {
+  Handle<JSObject> builtins(native_context()->builtins());
+
+  Handle<HeapObject> flag(FLAG_harmony_tolength ? heap()->true_value()
+                                                : heap()->false_value());
+  Runtime::SetObjectProperty(isolate(), builtins,
+                             factory()->harmony_tolength_string(), flag,
+                             STRICT).Assert();
+}
+
+
 void Genesis::InitializeGlobal_harmony_reflect() {
   Handle<JSObject> builtins(native_context()->builtins());
 
   Handle<JSFunction> apply = InstallFunction(
       builtins, "$reflectApply", JS_OBJECT_TYPE, JSObject::kHeaderSize,
       MaybeHandle<JSObject>(), Builtins::kReflectApply);
   apply->shared()->set_internal_formal_parameter_count(3);
   apply->shared()->set_length(3);
 
   native_context()->set_reflect_apply(*apply);
@@ skipping 642 matching lines @@
   static const char* harmony_spread_arrays_natives[] = {nullptr};
   static const char* harmony_sharedarraybuffer_natives[] = {
       "native harmony-sharedarraybuffer.js", NULL};
   static const char* harmony_atomics_natives[] = {"native harmony-atomics.js",
                                                   nullptr};
   static const char* harmony_new_target_natives[] = {nullptr};
   static const char* harmony_concat_spreadable_natives[] = {
       "native harmony-concat-spreadable.js", nullptr};
   static const char* harmony_simd_natives[] = {"native harmony-simd.js",
                                                nullptr};
+  static const char* harmony_tolength_natives[] = {nullptr};
 
   for (int i = ExperimentalNatives::GetDebuggerCount();
        i < ExperimentalNatives::GetBuiltinsCount(); i++) {
 #define INSTALL_EXPERIMENTAL_NATIVES(id, desc)                                \
   if (FLAG_##id) {                                                            \
     for (size_t j = 0; id##_natives[j] != NULL; j++) {                        \
       Vector<const char> script_name = ExperimentalNatives::GetScriptName(i); \
       if (strncmp(script_name.start(), id##_natives[j],                       \
                   script_name.length()) == 0) {                               \
         if (!Bootstrapper::CompileExperimentalBuiltin(isolate(), i)) {        \
@@ skipping 679 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8