[elements] Fix GetEntryForIndexImpl to honor array length

test/mjsunit/element-accessor.js

Index: test/mjsunit/element-accessor.js
diff --git a/test/mjsunit/element-accessor.js b/test/mjsunit/element-accessor.js
index 452afc8d168783038edf27e3f255e95884cbd316..5fba359c2a769cd5b46598bacc385c519ffa7762 100644
--- a/test/mjsunit/element-accessor.js
+++ b/test/mjsunit/element-accessor.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 (function () {
   var o = [];
   o.__proto__ = {};
@@ -31,3 +33,18 @@
   Object.defineProperty(o, "0", {get: function(){}});
   assertEquals(undefined, Object.getOwnPropertyDescriptor(o, "0"));
 })();
+
+(function() {
+  function f() {
+    var a = new Array();
+    a[1] = 1.5;
+    return a;
+  }
+
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  var a = f();
+  a[2] = 2;
+  assertEquals(3, a.length);
+})();