Avoid calling %AddElement with a number out of array index range

src/js/harmony-array.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
+var AddIndexedProperty;
 var FLAG_harmony_tolength;
 var GetIterator;
 var GetMethod;
 var GlobalArray = global.Array;
 var iteratorSymbol = utils.ImportNow("iterator_symbol");
 var MakeTypeError;
 var MaxSimple;
 var MinSimple;
 var ObjectIsFrozen;
 var ObjectDefineProperty;
 
 utils.Import(function(from) {
+  AddIndexedProperty = from.AddIndexedProperty;
   FLAG_harmony_tolength = from.FLAG_harmony_tolength;
   GetIterator = from.GetIterator;
   GetMethod = from.GetMethod;
   MakeTypeError = from.MakeTypeError;
   MaxSimple = from.MaxSimple;
   MinSimple = from.MinSimple;
   ObjectIsFrozen = from.ObjectIsFrozen;
   ObjectDefineProperty = from.ObjectDefineProperty;
 });
 
@@ skipping 139 matching lines @@
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.fill");
 
   var array = TO_OBJECT(this);
   var length = TO_LENGTH_OR_UINT32(array.length);
 
   return InnerArrayFill(value, start, end, array, length);
 }
 
 function AddArrayElement(constructor, array, i, value) {
   if (constructor === GlobalArray) {
-    %AddElement(array, i, value);
+    AddIndexedProperty(array, i, value);
   } else {
     ObjectDefineProperty(array, i, {
       value: value, writable: true, configurable: true, enumerable: true
     });
   }
 }
 
 // ES6, draft 10-14-14, section 22.1.2.1
 function ArrayFrom(arrayLike, mapfn, receiver) {
   var items = TO_OBJECT(arrayLike);
@@ skipping 97 matching lines @@
 
 utils.Export(function(to) {
   to.ArrayFrom = ArrayFrom;
   to.InnerArrayCopyWithin = InnerArrayCopyWithin;
   to.InnerArrayFill = InnerArrayFill;
   to.InnerArrayFind = InnerArrayFind;
   to.InnerArrayFindIndex = InnerArrayFindIndex;
 });
 
 })