ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/harmony-templates.js

Index: src/harmony-templates.js
diff --git a/src/harmony-templates.js b/src/harmony-templates.js
index 254f434fdfe0e6eb75a268b8774c6fa7a49b261e..efb260958f38b70569bf847ae81add980ab94c38 100644
--- a/src/harmony-templates.js
+++ b/src/harmony-templates.js
@@ -85,6 +85,9 @@ function StringRaw(callSite) {
 function ExtendStringForTemplates() {
   %CheckIsBootstrapping();
 
+  // Upgrade index conversion semantics to ES6.
+  ToLength.harmony = true;
+
   // Set up the non-enumerable functions on the String object.
   InstallFunctions($String, DONT_ENUM, $Array(
     "raw", StringRaw