ToInteger() resp. ToUint32() could possibly be replaced with ToLength() at the following positions:
9.3.12 CreateListFromArrayLike, step 3.
11.1.4.1, Runtime Semantics: Array Accumulation, "SpreadElement : ...AssignmentExpression", step 6.
11.2.5.1, Runtime Semantics: ArgumentListEvaluation, "ArgumentList : ...AssignmentExpression", step 7.
11.2.5.1, Runtime Semantics: ArgumentListEvaluation, "ArgumentList : ArgumentList , ...AssignmentExpression ", step 7.
11.13.3.2, Runtime Semantics: Indexed Destructuring Assignment Evaluation, "AssignmentRestElement : ...DestructuringAssignmentTarget", step 4.
15.4.2.3 Array.of, step 2.
15.4.2.4 Array.from, step 11.
15.5.3.14 String.prototype.split, step 8 to ensure consistency with 15.10.4.14 RegExp.prototype.split, step 11.
15.13.6.2.2 %TypedArray%.of, step 2.
15.13.6.2.3 %TypedArray%.from, step 12.
In the case of String.prototype.split, step 8, the default value of 2^32–1 should also be changed into ToLength(+∞), or 2^53-1 (if ToUint32 is replaced by ToLength).
fixed in rev20 editor's draft
fixed in rev20 draft, Oct. 28, 2013