ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/harmony-array.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
 var GetIterator;
 var GetMethod;
 var GlobalArray = global.Array;
 var GlobalSymbol = global.Symbol;
 var MathMax;
 var MathMin;
 var ObjectIsFrozen;
 var ObjectDefineProperty;
 var ToNumber;
+var ToLengthFlagged;
 
 utils.Import(function(from) {
   GetIterator = from.GetIterator;
   GetMethod = from.GetMethod;
   MathMax = from.MathMax;
   MathMin = from.MathMin;
   ObjectIsFrozen = from.ObjectIsFrozen;
   ObjectDefineProperty = from.ObjectDefineProperty;
   ToNumber = from.ToNumber;
+  ToLengthFlagged = from.ToLengthFlagged;
 });
 
 // -------------------------------------------------------------------
 
 function InnerArrayCopyWithin(target, start, end, array, length) {
   target = TO_INTEGER(target);
   var to;
   if (target < 0) {
     to = MathMax(length + target, 0);
   } else {
@@ skipping 140 matching lines @@
   for (; i < end; i++)
     array[i] = value;
   return array;
 }
 
 // ES6, draft 04-05-14, section 22.1.3.6
 function ArrayFill(value, start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }
 
 function AddArrayElement(constructor, array, i, value) {
   if (constructor === GlobalArray) {
     %AddElement(array, i, value);
   } else {
     ObjectDefineProperty(array, i, {
       value: value, writable: true, configurable: true, enumerable: true
@@ skipping 110 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayFrom = ArrayFrom;
   to.InnerArrayCopyWithin = InnerArrayCopyWithin;
   to.InnerArrayFill = InnerArrayFill;
   to.InnerArrayFind = InnerArrayFind;
   to.InnerArrayFindIndex = InnerArrayFindIndex;
 });
 
 })