Fix regress-crbug-412203.js

src/runtime.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <limits>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 10316 matching lines @@
         // and avoid duplicates.
         indices->Clear();
       }
       for (uint32_t i = 0; i < length; i++) {
         indices->Add(i);
       }
       if (length == range) return;  // All indices accounted for already.
       break;
     }
     case SLOPPY_ARGUMENTS_ELEMENTS: {
-      uint32_t length = static_cast<uint32_t>(
-          Handle<JSArray>::cast(object)->length()->Number());
+      MaybeHandle<Object> length_obj =
+          Object::GetProperty(object, isolate->factory()->length_string());
+      double length_num = length_obj.ToHandleChecked()->Number();
+      uint32_t length = static_cast<uint32_t>(DoubleToInt32(length_num));
       ElementsAccessor* accessor = object->GetElementsAccessor();
       for (uint32_t i = 0; i < length; i++) {
         if (accessor->HasElement(object, object, i)) {
           indices->Add(i);
         }
       }
       break;
     }
   }
 
@@ skipping 5327 matching lines @@
   }
   return NULL;
 }
 
 
 const Runtime::Function* Runtime::FunctionForId(Runtime::FunctionId id) {
   return &(kIntrinsicFunctions[static_cast<int>(id)]);
 }
 
 } }  // namespace v8::internal