Fix %GetWeakSetValues to work correctly with GC.

This fixes mjsunit/es6/mirror-collections failure in arm64 gc-stress bot.

BUG=

Review URL: https://codereview.chromium.org/783673002

Cr-Commit-Position: refs/heads/master@{#25687}

src/runtime/runtime-collections.cc

@@ -394,6 +394,10 @@ RUNTIME_FUNCTION(Runtime_GetWeakSetValues) {
     max_values = table->NumberOfElements();
   }
   Handle<FixedArray> values = isolate->factory()->NewFixedArray(max_values);
+  // Recompute max_values because GC could have removed elements from the table.
+  if (max_values > table->NumberOfElements()) {
+    max_values = table->NumberOfElements();
+  }
   {
     DisallowHeapAllocation no_gc;
     int count = 0;