Make sure when we shrink an object that we store a filler first into the free memory before updatin…

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 3949747c62ebed39506e88b5699400534e35d7e7..51a42c0ee4451b26b8b9e74abebd06b7baf423b7 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -1003,11 +1003,11 @@ class FastElementsAccessor
         if (length == 0) {
           array->initialize_elements();
         } else {
-          backing_store->set_length(length);
+          int filler_size = (old_capacity - length) * ElementSize;
           Address filler_start = backing_store->address() +
               BackingStore::OffsetOfElementAt(length);
-          int filler_size = (old_capacity - length) * ElementSize;
           array->GetHeap()->CreateFillerObjectAt(filler_start, filler_size);
+          backing_store->synchronized_set_length(length);
         }
       } else {
         // Otherwise, fill the unused tail with holes.