[keys] Throw a range error if the number of keys overflow FixedArray::kMaxLength

src/elements.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ELEMENTS_H_
 #define V8_ELEMENTS_H_
 
 #include "src/elements-kind.h"
 #include "src/heap/heap.h"
 #include "src/isolate.h"
@@ skipping 76 matching lines @@
                                     KeyAccumulator* keys) {
     CollectElementIndices(object, handle(object->elements(), keys->isolate()),
                           keys);
   }
 
   virtual Maybe<bool> CollectValuesOrEntries(
       Isolate* isolate, Handle<JSObject> object,
       Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
       PropertyFilter filter = ALL_PROPERTIES) = 0;
 
-  virtual Handle<FixedArray> PrependElementIndices(
+  virtual MaybeHandle<FixedArray> PrependElementIndices(
       Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
       Handle<FixedArray> keys, GetKeysConversion convert,
       PropertyFilter filter = ALL_PROPERTIES) = 0;
 
-  inline Handle<FixedArray> PrependElementIndices(
+  inline MaybeHandle<FixedArray> PrependElementIndices(
       Handle<JSObject> object, Handle<FixedArray> keys,
       GetKeysConversion convert, PropertyFilter filter = ALL_PROPERTIES) {
     return PrependElementIndices(object, handle(object->elements()), keys,
                                  convert, filter);
   }
 
   virtual void AddElementsToKeyAccumulator(Handle<JSObject> receiver,
                                            KeyAccumulator* accumulator,
                                            AddKeyConversion convert) = 0;
 
@@ skipping 82 matching lines @@
                      bool allow_appending = false);
 
 MUST_USE_RESULT MaybeHandle<Object> ArrayConstructInitializeElements(
     Handle<JSArray> array,
     Arguments* args);
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_ELEMENTS_H_