[api] Fix possible OOB when using SetAndGrow

R=jkummerow@chromium.org
BUG=chromium:630217

Review-Url: https://codereview.chromium.org/2201023004
Cr-Commit-Position: refs/heads/master@{#38287}

src/objects.cc

@@ -9782,7 +9782,7 @@ Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
   int capacity = array->length();
   do {
     capacity = JSObject::NewElementsCapacity(capacity);
-  } while (capacity < index);
+  } while (capacity <= index);
   Handle<FixedArray> new_array =
       array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity);
   array->CopyTo(0, *new_array, 0, array->length());