FlattenIntoArray does not set length?

[ljharb]

Step 3.c.v.2 creates the data property for the index, but does not update the length property - certainly native Array [[DefineOwnProperty]] updates it for you (https://tc39.github.io/ecma262/#sec-array-exotic-objects-defineownproperty-p-desc step 3.h.ii) - but whatever's created with the species constructor may not.

Precedent is to manually set it:

• https://tc39.github.io/ecma262/#sec-array-len step 8
• https://tc39.github.io/ecma262/#sec-array.from step 5.e.iv.1
• https://tc39.github.io/ecma262/#sec-array.of step 8
• https://tc39.github.io/ecma262/#sec-array.prototype.concat step 6
• https://tc39.github.io/ecma262/#sec-array.prototype.pop step 3.a & step 4.e
• https://tc39.github.io/ecma262/#sec-array.prototype.push step 7
• https://tc39.github.io/ecma262/#sec-array.prototype.shift step 3.a & step 8
• https://tc39.github.io/ecma262/#sec-array.prototype.slice step 11
• https://tc39.github.io/ecma262/#sec-array.prototype.splice step 12 & step 19
• https://tc39.github.io/ecma262/#sec-array.prototype.unshift step 5
• https://tc39.github.io/ecma262/#sec-arraycreate step 10

I think you'd want to add it as 3.c.v.3?