One more LookupIterator indexed/named mode fix

Reported at comment #18 of the linked bug.

Bug: chromium:1027461
Change-Id: I64fb4c4edd4df07ddf86c508dfecec7f509efc9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940262Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65263}

src/objects/js-objects.cc

@@ -262,7 +262,10 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
     }
 
     if (use_set) {
-      LookupIterator it(target, next_key, target);
+      bool success;
+      LookupIterator it = LookupIterator::PropertyOrElement(isolate, target,
+                                                            next_key, &success);
+      CHECK(success);
       Maybe<bool> result =
           Object::SetProperty(&it, prop_value, StoreOrigin::kNamed,
                               Just(ShouldThrow::kThrowOnError));

test/mjsunit/regress/large-indices.js

@@ -97,3 +97,10 @@
   obj[9007199254740991] = 1;
   Object.values(obj);
 })();
+
+// crbug.com/1027461#c18
+(function() {
+  const v7 = Object(1);
+  v7[4294967297] = 1;
+  const v8 = Object.assign({}, v7);
+})();