It indexes a FixedArray out of bounds, accessing an arbitrary object which
happens to be in that location. Now the object can also be an in-place weak ref,
which will cause a crash when trying to use it.

BUG=v8:5651

Change-Id: I73e4169e573ecb23e383970d7db336be08f5903c
Reviewed-on: https://chromium-review.googlesource.com/1148055Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54632}