Don't use length property when bounds checking atomics functions

test/mjsunit/harmony/atomics.js

Index: test/mjsunit/harmony/atomics.js
diff --git a/test/mjsunit/harmony/atomics.js b/test/mjsunit/harmony/atomics.js
index ff403b8bd1d47cc0b53d994220abc90025ec52f7..f59dffd1eea4656ff38dc24b48024aa52e501f7a 100644
--- a/test/mjsunit/harmony/atomics.js
+++ b/test/mjsunit/harmony/atomics.js
@@ -123,6 +123,21 @@ function testAtomicOp(op, ia, index, expectedIndex, name) {
     assertEquals(undefined, Atomics.xor(si32a, i, 0), name);
     assertEquals(undefined, Atomics.exchange(si32a, i, 0), name);
   });
+
+  // Monkey-patch length and make sure these functions still return undefined.
+  Object.defineProperty(si32a, 'length', {get: function() { return 1000; }});
+  [2, 100].forEach(function(i) {
+    var name = String(i);
+    assertEquals(undefined, Atomics.compareExchange(si32a, i, 0, 0), name);
+    assertEquals(undefined, Atomics.load(si32a, i), name);
+    assertEquals(undefined, Atomics.store(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.add(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.sub(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.and(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.or(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.xor(si32a, i, 0), name);
+    assertEquals(undefined, Atomics.exchange(si32a, i, 0), name);
+  });
 })();
 
 (function TestGoodIndex() {