Avoid calling %AddElement with a number out of array index range

src/js/array.js

Index: src/js/array.js
diff --git a/src/js/array.js b/src/js/array.js
index 0eb06fac8fd8fbd876446aab61a0515559884359..7b8fd60b9ff7ea38baf2e7be3c9b2a2cda6d9f6b 100644
--- a/src/js/array.js
+++ b/src/js/array.js
@@ -11,6 +11,7 @@
 // -------------------------------------------------------------------
 // Imports
 
+var AddLargeElement;

[adamk, 2015/10/28 19:52:50]

Missed a rename here.

 var Delete;
 var FLAG_harmony_tolength;
 var GlobalArray = global.Array;
@@ -28,6 +29,7 @@ var ObserveEnqueueSpliceRecord;
 var unscopablesSymbol = utils.ImportNow("unscopables_symbol");
 
 utils.Import(function(from) {
+  AddIndexedElement = from.AddIndexedElement;
   Delete = from.Delete;
   MakeTypeError = from.MakeTypeError;
   MinSimple = from.MinSimple;
@@ -245,7 +247,7 @@ function SparseSlice(array, start_i, del_count, len, deleted_elements) {
     for (var i = start_i; i < limit; ++i) {
       var current = array[i];
       if (!IS_UNDEFINED(current) || i in array) {
-        %AddElement(deleted_elements, i - start_i, current);
+        AddIndexedElement(deleted_elements, i - start_i, current);
       }
     }
   } else {
@@ -256,7 +258,7 @@ function SparseSlice(array, start_i, del_count, len, deleted_elements) {
         if (key >= start_i) {
           var current = array[key];
           if (!IS_UNDEFINED(current) || key in array) {
-            %AddElement(deleted_elements, key - start_i, current);
+            AddIndexedElement(deleted_elements, key - start_i, current);
           }
         }
       }
@@ -336,9 +338,9 @@ function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
     var index = start_i + i;
     if (HAS_INDEX(array, index, is_array)) {
       var current = array[index];
-      // The spec requires [[DefineOwnProperty]] here, %AddElement is close
-      // enough (in that it ignores the prototype).
-      %AddElement(deleted_elements, i, current);
+      // The spec requires [[DefineOwnProperty]] here, AddIndexedElement is
+      // close enough (in that it ignores the prototype).
+      AddIndexedElement(deleted_elements, i, current);
     }
   }
 }