ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

test/mjsunit/harmony/array-fill.js

Index: test/mjsunit/harmony/array-fill.js
diff --git a/test/mjsunit/harmony/array-fill.js b/test/mjsunit/harmony/array-fill.js
index eae18d113bf7e3d4fbbc2ecba48940009fc08f5b..2bbd4af53ffbfcc1eb20f3766d4af212c6d210d4 100644
--- a/test/mjsunit/harmony/array-fill.js
+++ b/test/mjsunit/harmony/array-fill.js
@@ -30,3 +30,23 @@ assertArrayEquals(Object.freeze([1, 2, 3]).fill(0, 0, 0), [1, 2, 3]);
 assertThrows('Object.freeze([0]).fill()', TypeError);
 assertThrows('Array.prototype.fill.call(null)', TypeError);
 assertThrows('Array.prototype.fill.call(undefined)', TypeError);
+
+// Test with large values, and negative start offset and end offset
+var o = { length: Number.MIN_VALUE };
+var result = Array.prototype.fill.call(o, "foo");
+assertEquals(Number.MIN_VALUE, result.length);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+Array.prototype.fill.call(o, "foo", 0, 9);
+assertEquals(Number.MAX_SAFE_INTEGER, o.length);
+assertEquals("foo", o[0]);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+Array.prototype.fill.call(o, "foo", 0, Number.MIN_SAFE_INTEGER);
+assertEquals(Number.MAX_SAFE_INTEGER, o.length);
+assertEquals(undefined, o[0]);
+
+var o = { length: Number.MAX_SAFE_INTEGER };
+Array.prototype.fill.call(o, "foo", Number.MIN_SAFE_INTEGER, 0);
+assertEquals(Number.MAX_SAFE_INTEGER, o.length);
+assertEquals(undefined, o[0]);