ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 9d2121e54379ecb51d812aff8acfbfb7bb43babc..82db59aef44fb7338af8853ae96ba56bc09d6421 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1814,6 +1814,17 @@ void Genesis::InitializeGlobal_harmony_unicode_regexps() {
 }
 
 
+void Genesis::InitializeGlobal_harmony_tolength() {
+  Handle<JSObject> builtins(native_context()->builtins());
+
+  Handle<HeapObject> flag(FLAG_harmony_tolength ? heap()->true_value()
+                                                : heap()->false_value());
+  Runtime::SetObjectProperty(isolate(), builtins,
+                             factory()->harmony_tolength_string(), flag,
+                             STRICT).Assert();
+}
+
+
 void Genesis::InitializeGlobal_harmony_reflect() {
   Handle<JSObject> builtins(native_context()->builtins());
 
@@ -2476,6 +2487,7 @@ bool Genesis::InstallExperimentalNatives() {
       "native harmony-concat-spreadable.js", nullptr};
   static const char* harmony_simd_natives[] = {"native harmony-simd.js",
                                                nullptr};
+  static const char* harmony_tolength_natives[] = {nullptr};
 
   for (int i = ExperimentalNatives::GetDebuggerCount();
        i < ExperimentalNatives::GetBuiltinsCount(); i++) {