Add bounds-checking in runtime implementations of %FixedArray{Get,Set}

src/runtime/runtime-array.cc

Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index 1617245daf3206fce4638c57e388f88c226f7f8a..a7542ecb2ed9f7391c15c5daee16b3b44687e655 100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -58,19 +58,21 @@ RUNTIME_FUNCTION(Runtime_SpecialArrayFunctions) {
 RUNTIME_FUNCTION(Runtime_FixedArrayGet) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
-  CONVERT_ARG_CHECKED(FixedArray, object, 0);
+  CONVERT_ARG_CHECKED(FixedArray, array, 0);
   CONVERT_SMI_ARG_CHECKED(index, 1);
-  return object->get(index);
+  RUNTIME_ASSERT(index < array->length());
+  return array->get(index);
 }
 
 
 RUNTIME_FUNCTION(Runtime_FixedArraySet) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 3);
-  CONVERT_ARG_CHECKED(FixedArray, object, 0);
+  CONVERT_ARG_CHECKED(FixedArray, array, 0);
   CONVERT_SMI_ARG_CHECKED(index, 1);
   CONVERT_ARG_CHECKED(Object, value, 2);
-  object->set(index, value);
+  RUNTIME_ASSERT(index < array->length());
+  array->set(index, value);
   return isolate->heap()->undefined_value();
 }