Ship Harmony ToLength

This patch moves ES2015 ToLength semantics on array operations, etc
to from staging to shipping.

R=adamk
BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1433473003

Cr-Commit-Position: refs/heads/master@{#31810}

src/flag-definitions.h

@@ -210,7 +210,6 @@ DEFINE_IMPLICATION(es_staging, harmony_destructuring)
 #define HARMONY_STAGED(V)                                     \
   V(harmony_regexps, "harmony regular expression extensions") \
   V(harmony_tostring, "harmony toString")                     \
-  V(harmony_tolength, "harmony ToLength")                     \
   V(harmony_sloppy, "harmony features in sloppy mode")        \
   V(harmony_sloppy_let, "harmony let in sloppy mode")
 
@@ -220,6 +219,7 @@ DEFINE_IMPLICATION(es_staging, harmony_destructuring)
   V(harmony_object_observe, "harmony Object.observe")           \
   V(harmony_rest_parameters, "harmony rest parameters")         \
   V(harmony_concat_spreadable, "harmony isConcatSpreadable")    \
+  V(harmony_tolength, "harmony ToLength")                       \
   V(harmony_completion, "harmony completion value semantics")
 
 // Once a shipping feature has proved stable in the wild, it will be dropped

test/mjsunit/array-indexing.js

@@ -111,7 +111,7 @@ assertEquals(10, Array.prototype.indexOf.call(funky_object, 42));
 assertEquals(-1, Array.prototype.indexOf.call(funky_object, 42, 15));
 assertEquals(-1, Array.prototype.indexOf.call(funky_object, 37));
 
-assertEquals(-1, Array.prototype.indexOf.call(infinite_object, 42));
+assertEquals(10, Array.prototype.indexOf.call(infinite_object, 42));
 
 // ----------------------------------------------------------------------
 // Array.prototype.lastIndexOf.
@@ -183,4 +183,5 @@ assertEquals(10, Array.prototype.lastIndexOf.call(funky_object, 42, 15));
 assertEquals(10, Array.prototype.lastIndexOf.call(funky_object, 42));
 assertEquals(-1, Array.prototype.lastIndexOf.call(funky_object, 37));
 
-assertEquals(-1, Array.prototype.lastIndexOf.call(infinite_object, 42));
+// This call would take too long because it would search backwards from 2**53-1
+// assertEquals(-1, Array.prototype.lastIndexOf.call(infinite_object, 42));

test/mjsunit/array-length.js

@@ -115,7 +115,7 @@ assertEquals(20, a.length);
 
 var o = { length: -23 };
 Array.prototype.pop.apply(o);
-assertEquals(4294967272, o.length);
+assertEquals(0, o.length);
 
 // Check case of compiled stubs.
 var a = [];

test/mozilla/mozilla.status

@@ -87,6 +87,9 @@
   # In ES6, the completion value of a 0-iterations loop is 'undefined'.
   'ecma/Statements/12.6.3-2': [PASS, FAIL],
 
+  # ES2015 ToLength semantics
+  'ecma_3/RegExp/15.10.6.2-2': [FAIL],
+
   ##################### SKIPPED TESTS #####################
 
   # This test checks that we behave properly in an out-of-memory