Fix for 350887: CHECK failure on new_length->IsSmi()

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1841 matching lines @@
   // Fast case: The new length fits into a Smi.
   MaybeObject* maybe_smi_length = length->ToSmi();
   Object* smi_length = Smi::FromInt(0);
   if (maybe_smi_length->ToObject(&smi_length) && smi_length->IsSmi()) {
     const int value = Smi::cast(smi_length)->value();
     if (value >= 0) {
       Object* new_length;
       MaybeObject* result = ElementsAccessorSubclass::
           SetLengthWithoutNormalize(backing_store, array, smi_length, value);
       if (!result->ToObject(&new_length)) return result;
-      ASSERT(new_length->IsSmi() || new_length->IsUndefined());
+      // even though the proposed length was a smi, new_length could
+      // still be a heap number because SetLengthWithoutNormalize doesn't
+      // allow the array length property to drop below the index of
+      // non-deletable elements.
+      ASSERT(new_length->IsSmi() || new_length->IsHeapNumber() ||
+             new_length->IsUndefined());
       if (new_length->IsSmi()) {
         array->set_length(Smi::cast(new_length));
         return array;
+      } else if (new_length->IsHeapNumber()) {
+        array->set_length(new_length);
+        return array;
       }
     } else {
       return ThrowArrayLengthRangeError(array->GetHeap());
     }
   }
 
   // Slow case: The new length does not fit into a Smi or conversion
   // to slow elements is needed for other reasons.
   if (length->IsNumber()) {
     uint32_t value;
@@ skipping 116 matching lines @@
       UNREACHABLE();
       break;
   }
 
   array->set_elements(elms);
   array->set_length(Smi::FromInt(number_of_elements));
   return array;
 }
 
 } }  // namespace v8::internal