ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/array-iterator.js

Index: src/array-iterator.js
diff --git a/src/array-iterator.js b/src/array-iterator.js
index 67f1eeff9ed4eca712dec66247eb821d76d75f39..9765d547456ee65ab076f8987d3071ceae875ee8 100644
--- a/src/array-iterator.js
+++ b/src/array-iterator.js
@@ -20,6 +20,12 @@ var arrayIteratorNextIndexSymbol =
 var arrayIteratorObjectSymbol =
     utils.GetPrivateSymbol("array_iterator_object_symbol");
 var GlobalArray = global.Array;
+var ToLengthFlagged;
+
+utils.Import(function(from) {
+  ToLengthFlagged = from.ToLengthFlagged;
+});
+
 
 macro TYPED_ARRAYS(FUNCTION)
   FUNCTION(Uint8Array)
@@ -88,7 +94,7 @@ function ArrayIteratorNext() {
 
   var index = GET_PRIVATE(iterator, arrayIteratorNextIndexSymbol);
   var itemKind = GET_PRIVATE(iterator, arrayIterationKindSymbol);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
 
   // "sparse" is never used.