When notifying observers of a truncated array, don't call getters on deleted element indices

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 944c5a15e596a885beb807833bdcc40e1fad9508..6b991ebf131e100fbcefd4abe48ca8b37711bacc 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9442,8 +9442,10 @@ MaybeObject* JSArray::SetElementsLength(Object* len) {
     // A non-configurable property will cause the truncation operation to
     // stop at this index.
     if (attributes == DONT_DELETE) break;
-    // TODO(adamk): Don't fetch the old value if it's an accessor.
-    old_values.Add(Object::GetElement(self, i));
+    old_values.Add(
+        self->GetLocalElementAccessorPair(i) == NULL
+        ? Object::GetElement(self, i)
+        : Handle<Object>::cast(isolate->factory()->the_hole_value()));
     indices.Add(isolate->factory()->Uint32ToString(i));
   }