ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/harmony-array.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
@@ skipping 155 matching lines @@
   for (; i < end; i++)
     array[i] = value;
   return array;
 }
 
 // ES6, draft 04-05-14, section 22.1.3.6
 function ArrayFill(value, start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = TO_LENGTH_OR_UINT32(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }
 
 function AddArrayElement(constructor, array, i, value) {
   if (constructor === GlobalArray) {
     %AddElement(array, i, value);
   } else {
     ObjectDefineProperty(array, i, {
       value: value, writable: true, configurable: true, enumerable: true
@@ skipping 104 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayFrom = ArrayFrom;
   to.InnerArrayCopyWithin = InnerArrayCopyWithin;
   to.InnerArrayFill = InnerArrayFill;
   to.InnerArrayFind = InnerArrayFind;
   to.InnerArrayFindIndex = InnerArrayFindIndex;
 });
 
 })