ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/harmony-array.js

Index: src/harmony-array.js
diff --git a/src/harmony-array.js b/src/harmony-array.js
index 49176460ad2ee42fe38dcc4d6ef18d20e3f4e06e..90c1b99979011bed3800f8a84891b5400fad4965 100644
--- a/src/harmony-array.js
+++ b/src/harmony-array.js
@@ -20,6 +20,7 @@ var MathMin;
 var ObjectIsFrozen;
 var ObjectDefineProperty;
 var ToNumber;
+var ToLengthFlagged;
 
 utils.Import(function(from) {
   GetIterator = from.GetIterator;
@@ -29,6 +30,7 @@ utils.Import(function(from) {
   ObjectIsFrozen = from.ObjectIsFrozen;
   ObjectDefineProperty = from.ObjectDefineProperty;
   ToNumber = from.ToNumber;
+  ToLengthFlagged = from.ToLengthFlagged;
 });
 
 // -------------------------------------------------------------------
@@ -189,7 +191,7 @@ function ArrayFill(value, start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }