ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/harmony-array.js

Index: src/harmony-array.js
diff --git a/src/harmony-array.js b/src/harmony-array.js
index 705adcd06a30339082d8138c0d3bb302904276d5..c550447c3ef279cc1004b3159c0d8144edaf7389 100644
--- a/src/harmony-array.js
+++ b/src/harmony-array.js
@@ -173,7 +173,7 @@ function ArrayFill(value, start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = TO_LENGTH(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }