[api] Fix possible OOB when using SetAndGrow

src/objects.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <memory>
 #include <sstream>
@@ skipping 9764 matching lines @@
 
 Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
                                           Handle<Object> value) {
   if (index < array->length()) {
     array->set(index, *value);
     return array;
   }
   int capacity = array->length();
   do {
     capacity = JSObject::NewElementsCapacity(capacity);
-  } while (capacity < index);
+  } while (capacity <= index);
   Handle<FixedArray> new_array =
       array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity);
   array->CopyTo(0, *new_array, 0, array->length());
   new_array->FillWithHoles(array->length(), new_array->length());
   new_array->set(index, *value);
   return new_array;
 }
 
 void FixedArray::Shrink(int new_length) {
   DCHECK(0 <= new_length && new_length <= length());
@@ skipping 9241 matching lines @@
   for (PrototypeIterator iter(isolate, this, kStartAtReceiver,
                               PrototypeIterator::END_AT_NULL);
        !iter.IsAtEnd(); iter.AdvanceIgnoringProxies()) {
     if (iter.GetCurrent<Object>()->IsJSProxy()) return true;
   }
   return false;
 }
 
 }  // namespace internal
 }  // namespace v8