Avoid creating indexed elements at index maxUint32

The maximum indexed element size is maxUint32-1, not maxUint32, because
the maximum length of elements is maxUint32. This patch tweaks the limit
to switch to named properties as appropriate.

BUG=v8:4516
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1431503002

Cr-Commit-Position: refs/heads/master@{#31809}

src/js/macros.py

@@ -73,6 +73,9 @@ define kSafeArgumentsLength = 0x800000;
 # 2^53 - 1
 define kMaxSafeInteger = 9007199254740991;
 
+# 2^32 - 1
+define kMaxUint32 = 4294967295;
+
 # Strict mode flags for passing to %SetProperty
 define kSloppyMode = 0;
 define kStrictMode = 1;

src/js/runtime.js

@@ -210,7 +210,7 @@ function ConcatIterableToArray(target, iterable) {
 // argument might not be less than 2**32-1. ES2015 ToLength semantics mean that
 // this is a concern at basically all callsites.
 function AddIndexedProperty(obj, index, value) {
-  if (index === TO_UINT32(index)) {
+  if (index === TO_UINT32(index) && index !== kMaxUint32) {
     %AddElement(obj, index, value);
   } else {
     %AddNamedProperty(obj, TO_STRING(index), value, NONE);