Don't use length property when bounds checking atomics functions

test/mjsunit/harmony/atomics.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-atomics --harmony-sharedarraybuffer
 //
 
 function toRangeWrapped(value) {
   var range = this.max - this.min + 1;
   while (value < this.min) {
@@ skipping 105 matching lines @@
     assertEquals(undefined, Atomics.compareExchange(si32a, i, 0, 0), name);
     assertEquals(undefined, Atomics.load(si32a, i), name);
     assertEquals(undefined, Atomics.store(si32a, i, 0), name);
     assertEquals(undefined, Atomics.add(si32a, i, 0), name);
     assertEquals(undefined, Atomics.sub(si32a, i, 0), name);
     assertEquals(undefined, Atomics.and(si32a, i, 0), name);
     assertEquals(undefined, Atomics.or(si32a, i, 0), name);
     assertEquals(undefined, Atomics.xor(si32a, i, 0), name);
     assertEquals(undefined, Atomics.exchange(si32a, i, 0), name);
   });
+
+  // Monkey-patch length and make sure these functions still return undefined.
+  Object.defineProperty(si32a, 'length', {get: function() { return 1000; }});
+  [2, 100].forEach(function(i) {
+    var name = String(i);
+    assertEquals(undefined, Atomics.compareExchange(si32a, i, 0, 0), name);
+    assertEquals(undefined, Atomics.load(si32a, i), name);
+    assertEquals(undefined, Atomics.store(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.add(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.sub(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.and(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.or(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.xor(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.exchange(si32a, i, 0), name);
+  });
 })();
 
 (function TestGoodIndex() {
   var sab = new SharedArrayBuffer(64);
   var si32a = new Int32Array(sab);
 
   var valueOf = {valueOf: function(){ return 3;}};
   var toString = {toString: function(){ return '3';}};
 
   [3, 3.5, '3', '3.5', valueOf, toString].forEach(function(i) {
@@ skipping 299 matching lines @@
       // Exchange
       sta[0] = val = 0x12;
       operand = 0x22 + offset;
       valWrapped = t.toRange(operand);
       assertEquals(val, Atomics.exchange(sta, 0, operand), name);
       assertEquals(valWrapped, sta[0], name);
     }
 
   });
 })();