Fix Runtime_SetProperty to properly handle OOM failures

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 6b605e5841ebff66b737c36a11bac03b631a183e..86c8b38bd90415d08c7e2833e6fdabba9140dadd 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12057,7 +12057,7 @@ Handle<Object> JSObject::SetElement(Handle<JSObject> object,
                                     StrictModeFlag strict_mode,
                                     SetPropertyMode set_mode) {
   if (object->HasExternalArrayElements()) {
-    if (!value->IsSmi() && !value->IsHeapNumber() && !value->IsUndefined()) {
+    if (!value->IsNumber() && !value->IsUndefined()) {
       bool has_exception;
       Handle<Object> number = Execution::ToNumber(value, &has_exception);
       if (has_exception) return Handle<Object>();