Fix OOB access in Array.prototype.slice

Bug: chromium:791345
Change-Id: I81e5e23e2ddfc5e78a4ca922ceffda28516277c3
Reviewed-on: https://chromium-review.googlesource.com/806097Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49871}

src/builtins/builtins-array-gen.cc

@@ -1194,7 +1194,7 @@ class FastArraySliceCodeStubAssembler : public CodeStubAssembler {
     Node* unmapped_elements_length =
         LoadFixedArrayBaseLength(unmapped_elements);
 
-    GotoIf(SmiGreaterThan(end, unmapped_elements_length), slow);
+    GotoIf(SmiAbove(end, unmapped_elements_length), slow);
 
     Node* array_map = LoadJSArrayElementsMap(HOLEY_ELEMENTS, native_context);
     result.Bind(AllocateJSArray(HOLEY_ELEMENTS, array_map, count, count,

test/mjsunit/regress/regress-791345.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function(a) {
+    var len = 0x80000000;
+    arguments.length = len;
+    Array.prototype.slice.call(arguments, len - 1, len);
+}('a'));
+
+(function(a) {
+    var len = 0x40000000;
+    arguments.length = len;
+    Array.prototype.slice.call(arguments, len - 1, len);
+}('a'));