[api] Fix possible OOB when using SetAndGrow

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 56cf5b30bf6ebdb20e5301359ef2c6c37acd9ff4..c541097a301d4acf9d30ac94900c9aaba4a4fe83 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9782,7 +9782,7 @@ Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
   int capacity = array->length();
   do {
     capacity = JSObject::NewElementsCapacity(capacity);
-  } while (capacity < index);
+  } while (capacity <= index);
   Handle<FixedArray> new_array =
       array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity);
   array->CopyTo(0, *new_array, 0, array->length());