ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/object-observe.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $observeEnqueueSpliceRecord;
 var $observeBeginPerformSplice;
 var $observeEndPerformSplice;
 
 var $observeObjectMethods;
 var $observeArrayMethods;
@@ skipping 675 matching lines @@
   "observe", ObjectObserve,
   "unobserve", ObjectUnobserve
 ];
 $observeArrayMethods = [
   "observe", ArrayObserve,
   "unobserve", ArrayUnobserve
 ];
 
 // TODO(adamk): Figure out why this prototype removal has to
 // happen as part of initial snapshotting.
-var removePrototypeFn = function(f, i) {
+var removePrototypeFn = function (f, i) {

[Camillo Bruni, 2015/09/09 13:51:16]

DAT space :D

[aperez, 2015/09/09 18:20:45]

Acknowledged.

   if (i % 2 === 1) %FunctionRemovePrototype(f);
 };
 $observeObjectMethods.forEach(removePrototypeFn);
 $observeArrayMethods.forEach(removePrototypeFn);
 
 $observeEnqueueSpliceRecord = EnqueueSpliceRecord;
 $observeBeginPerformSplice = BeginPerformSplice;
 $observeEndPerformSplice = EndPerformSplice;
 
 %InstallToContext([
   "native_object_get_notifier", NativeObjectGetNotifier,
   "native_object_notifier_perform_change", NativeObjectNotifierPerformChange,
   "native_object_observe", NativeObjectObserve,
   "observers_begin_perform_splice", BeginPerformSplice,
   "observers_end_perform_splice", EndPerformSplice,
   "observers_enqueue_splice", EnqueueSpliceRecord,
   "observers_notify_change", NotifyChange,
 ]);
 
 })