When notifying observers of a truncated array, don't call getters on deleted element indices

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 9424 matching lines @@
     return Failure::InternalError();
 
   // TODO(adamk): This loop can be very slow for arrays in dictionary mode.
   // Find another way to iterate over arrays with dictionary elements.
   for (uint32_t i = old_length - 1; i + 1 > new_length; --i) {
     PropertyAttributes attributes = self->GetLocalElementAttribute(i);
     if (attributes == ABSENT) continue;
     // A non-configurable property will cause the truncation operation to
     // stop at this index.
     if (attributes == DONT_DELETE) break;
-    // TODO(adamk): Don't fetch the old value if it's an accessor.
-    old_values.Add(Object::GetElement(self, i));
+    old_values.Add(
+        self->GetLocalElementAccessorPair(i) == NULL
+        ? Object::GetElement(self, i)
+        : Handle<Object>::cast(isolate->factory()->the_hole_value()));
     indices.Add(isolate->factory()->Uint32ToString(i));
   }
 
   MaybeObject* result =
       self->GetElementsAccessor()->SetLength(*self, *new_length_handle);
   Handle<Object> hresult;
   if (!result->ToHandle(&hresult, isolate)) return result;
 
   CHECK(self->length()->ToArrayIndex(&new_length));
   if (old_length != new_length) {
@@ skipping 4428 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal