Avoid creating indexed elements at index maxUint32

src/js/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This files contains runtime support implemented in JavaScript.
 
 // CAUTION: Some of the functions specified in this file are called
 // directly from compiled code. These are the functions with names in
 // ALL CAPS. The compiled code passes the first argument in 'this'.
 
@@ skipping 192 matching lines @@
 /* ---------------------------------
    - - -   U t i l i t i e s   - - -
    ---------------------------------
 */
 
 
 // This function should be called rather than %AddElement in contexts where the
 // argument might not be less than 2**32-1. ES2015 ToLength semantics mean that
 // this is a concern at basically all callsites.
 function AddIndexedProperty(obj, index, value) {
-  if (index === TO_UINT32(index)) {
+  if (index < kMaxUint32) {

[Jakob Kummerow, 2015/10/30 09:38:05]

How do you guarantee that index >= 0?

     %AddElement(obj, index, value);
   } else {
     %AddNamedProperty(obj, TO_STRING(index), value, NONE);
   }
 }
 %SetForceInlineFlag(AddIndexedProperty);
 
 
 // ES6, draft 10-14-14, section 22.1.3.1.1
 function IsConcatSpreadable(O) {
@@ skipping 50 matching lines @@
   "concat_iterable_to_array_builtin", CONCAT_ITERABLE_TO_ARRAY,
   "reflect_apply_prepare_builtin", REFLECT_APPLY_PREPARE,
   "reflect_construct_prepare_builtin", REFLECT_CONSTRUCT_PREPARE,
 ]);
 
 %InstallToContext([
   "concat_iterable_to_array", ConcatIterableToArray,
 ]);
 
 })