Fix bug in Object.defineProperty where a growing lements dictionary was ignored.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 1fffa8214768a607c38115e84518d1700c61c081..6e70b9caac7400cf0503a57741311ef017df9dbb 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -3914,7 +3914,11 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_DefineOrRedefineDataProperty) {
     // Make sure that we never go back to fast case.
     dictionary->set_requires_slow_elements();
     PropertyDetails details = PropertyDetails(attr, NORMAL);
-    NumberDictionarySet(dictionary, index, obj_value, details);
+    Handle<NumberDictionary> extended_dictionary =
+        NumberDictionarySet(dictionary, index, obj_value, details);
+    if (*extended_dictionary != *dictionary) {
+      js_object->set_elements(*extended_dictionary);
+    }
     return *obj_value;
   }