Modify %AddElement to accept large indices out of array bounds

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index 28726cba56672788e404fa8a0e72af92cd48ec54..46d6be87d3e104ece07b57eeede17dd60e4b479f 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -507,6 +507,7 @@ RUNTIME_FUNCTION(Runtime_AddNamedProperty) {
 
 // Adds an element to an array.
 // This is used to create an indexed data property into an array.
+// TODO(littledan): Eliminate AddElement and switch to something less hacky.
 RUNTIME_FUNCTION(Runtime_AddElement) {
   HandleScope scope(isolate);
   RUNTIME_ASSERT(args.length() == 3);
@@ -516,25 +517,40 @@ RUNTIME_FUNCTION(Runtime_AddElement) {
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 
   uint32_t index = 0;
-  CHECK(key->ToArrayIndex(&index));
 
+  Handle<Object> result;
+  if (key->ToArrayIndex(&index)) {
 #ifdef DEBUG
-  LookupIterator it(isolate, object, index,
-                    LookupIterator::OWN_SKIP_INTERCEPTOR);
-  Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-  if (!maybe.IsJust()) return isolate->heap()->exception();
-  RUNTIME_ASSERT(!it.IsFound());
+    LookupIterator it(isolate, object, index,
+                      LookupIterator::OWN_SKIP_INTERCEPTOR);
+    Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
+    if (!maybe.IsJust()) return isolate->heap()->exception();
+    RUNTIME_ASSERT(!it.IsFound());
 
-  if (object->IsJSArray()) {
-    Handle<JSArray> array = Handle<JSArray>::cast(object);
-    RUNTIME_ASSERT(!JSArray::WouldChangeReadOnlyLength(array, index));
-  }
+    if (object->IsJSArray()) {
+      Handle<JSArray> array = Handle<JSArray>::cast(object);
+      RUNTIME_ASSERT(!JSArray::WouldChangeReadOnlyLength(array, index));
+    }
 #endif
 
-  Handle<Object> result;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result,
-      JSObject::SetOwnElementIgnoreAttributes(object, index, value, NONE));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, result,
+        JSObject::SetOwnElementIgnoreAttributes(object, index, value, NONE));
+  } else {
+    MaybeHandle<Name> maybe_name = Object::ToName(isolate, key);
+    Handle<Name> name = maybe_name.ToHandleChecked();
+
+#ifdef DEBUG
+    LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+    Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
+    if (!maybe.IsJust()) return isolate->heap()->exception();
+    RUNTIME_ASSERT(!it.IsFound());
+#endif
+
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, result,
+        JSObject::SetOwnPropertyIgnoreAttributes(object, name, value, NONE));
+  }
   return *result;
 }