ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This files contains runtime support implemented in JavaScript.
 
 // CAUTION: Some of the functions specified in this file are called
 // directly from compiled code. These are the functions with names in
 // ALL CAPS. The compiled code passes the first argument in 'this'.
 
 
 // The following declarations are shared with other native JS files.
 // They are all declared at this one spot to avoid redeclaration errors.
 var $defaultString;
 var $NaN;
 var $nonNumberToNumber;
 var $nonStringToString;
 var $sameValue;
 var $sameValueZero;
 var $toInteger;
 var $toLength;
 var $toNumber;
 var $toPositiveInteger;
 var $toPrimitive;
 var $toString;
 
+var harmony_tolength = false;
+
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 var GlobalArray = global.Array;
 var GlobalBoolean = global.Boolean;
 var GlobalString = global.String;
 var GlobalNumber = global.Number;
 var isConcatSpreadableSymbol =
     utils.ImportNow("is_concat_spreadable_symbol");
@@ skipping 793 matching lines @@
 
 utils.Export(function(to) {
   to.ToBoolean = ToBoolean;
   to.ToLength = ToLength;
   to.ToNumber = ToNumber;
   to.ToPrimitive = ToPrimitive;
   to.ToString = ToString;
 });
 
 })