ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/heap/heap.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_HEAP_H_
 #define V8_HEAP_HEAP_H_
 
 #include <cmath>
 #include <map>
 
@@ skipping 241 matching lines @@
   V(nan_string, "NaN")                                         \
   V(source_string, "source")                                   \
   V(source_url_string, "source_url")                           \
   V(source_mapping_url_string, "source_mapping_url")           \
   V(this_string, "this")                                       \
   V(global_string, "global")                                   \
   V(ignore_case_string, "ignoreCase")                          \
   V(multiline_string, "multiline")                             \
   V(sticky_string, "sticky")                                   \
   V(unicode_string, "unicode")                                 \
+  V(harmony_tolength_string, "harmony_tolength")               \
   V(input_string, "input")                                     \
   V(index_string, "index")                                     \
   V(last_index_string, "lastIndex")                            \
   V(object_string, "object")                                   \
   V(prototype_string, "prototype")                             \
   V(string_string, "string")                                   \
   V(String_string, "String")                                   \
   V(symbol_string, "symbol")                                   \
   V(Symbol_string, "Symbol")                                   \
   V(Map_string, "Map")                                         \
@@ skipping 2434 matching lines @@
   DisallowHeapAllocation no_allocation;  // i.e. no gc allowed.
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(PathTracer);
 };
 #endif  // DEBUG
 }
 }  // namespace v8::internal
 
 #endif  // V8_HEAP_HEAP_H_