Avoid calling %AddElement with a number out of array index range

src/js/harmony-array.js

Index: src/js/harmony-array.js
diff --git a/src/js/harmony-array.js b/src/js/harmony-array.js
index d100c0dbea4d17b5638639f9d519a70250030ab8..d979c4769d22923ec8ddc1e65a3ece55d84d6ac5 100644
--- a/src/js/harmony-array.js
+++ b/src/js/harmony-array.js
@@ -11,6 +11,7 @@
 // -------------------------------------------------------------------
 // Imports
 
+var AddLargeElement;
 var FLAG_harmony_tolength;
 var GetIterator;
 var GetMethod;
@@ -23,6 +24,7 @@ var ObjectIsFrozen;
 var ObjectDefineProperty;
 
 utils.Import(function(from) {
+  AddLargeElement = from.AddLargeElement;
   FLAG_harmony_tolength = from.FLAG_harmony_tolength;
   GetIterator = from.GetIterator;
   GetMethod = from.GetMethod;
@@ -182,7 +184,7 @@ function ArrayFill(value, start, end) {
 
 function AddArrayElement(constructor, array, i, value) {

[adamk, 2015/10/27 22:03:07]

Do we still need this wrapper? Is it guarding something different than the one
you're adding?

[Dan Ehrenberg, 2015/10/28 18:44:43]

I had the same impulse at first, to remove it, but I don't think it's legitimate
to assume that a random object has an array backing store. I think in the other
cases, we are able to call %AddElement because we're constructing a new array,
but that's not the case for Array.from, Array.of when called with another object
as the receiver.

[adamk, 2015/10/28 19:52:50]

All objects have en element backing store for indexed properties that are
representable as a uint32. As long as the property is known to not pre-exist on
the instance, %AddElement should be safe.

[adamk, 2015/10/28 20:03:07]

But Array.from and Array.of call arbitrary user code to construct their objects,
so there's no guarantee about the non-existence of properties on the object. So
I'm wrong, and this should stay as-is.

   if (constructor === GlobalArray) {
-    %AddElement(array, i, value);
+    AddLargeElement(array, i, value);
   } else {
     ObjectDefineProperty(array, i, {
       value: value, writable: true, configurable: true, enumerable: true