[es6] correct constant_elements backing-store when spread is used

src/ast.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ast.h"
 
 #include <cmath>  // For isfinite.
 #include "src/builtins.h"
 #include "src/code-stubs.h"
 #include "src/contexts.h"
@@ skipping 530 matching lines @@
 
     JSObject::AddDataElement(array, array_index, boilerplate_value, NONE)
         .Assert();
   }
 
   if (array_index != values()->length()) {
     JSArray::SetLength(array, array_index);
   }
   JSObject::ValidateElements(array);
   Handle<FixedArrayBase> element_values(array->elements());
+  if (array_index != values()->length()) {
+    element_values->set_length(array_index);
+  }
 
   // Simple and shallow arrays can be lazily copied, we transform the
   // elements array to a copy-on-write array.
   if (is_simple && depth_acc == 1 && array_index > 0 &&
       array->HasFastSmiOrObjectElements()) {
     element_values->set_map(isolate->heap()->fixed_cow_array_map());
   }
 
   // Remember both the literal's constant values as well as the ElementsKind
   // in a 2-element FixedArray.
@@ skipping 584 matching lines @@
 bool Literal::Match(void* literal1, void* literal2) {
   const AstValue* x = static_cast<Literal*>(literal1)->raw_value();
   const AstValue* y = static_cast<Literal*>(literal2)->raw_value();
   return (x->IsString() && y->IsString() && x->AsString() == y->AsString()) ||
          (x->IsNumber() && y->IsNumber() && x->AsNumber() == y->AsNumber());
 }
 
 
 }  // namespace internal
 }  // namespace v8