Fix index bug in splicing dictionary element arrays

Bug: chromium:783119
Change-Id: I617db4f6740fb2cfe036ccf162a12aa2bac28e86
Reviewed-on: https://chromium-review.googlesource.com/763460Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49320}

src/elements.cc

@@ -1452,8 +1452,8 @@ class DictionaryElementsAccessor
           Handle<Object> value(source_dict->ValueAt(i), isolate);
           PropertyDetails details = source_dict->DetailsAt(i);
           PropertyAttributes attr = details.attributes();
-          AddImpl(result_array, static_cast<uint32_t>(key_value), value, attr,
-                  0);
+          AddImpl(result_array, static_cast<uint32_t>(key_value) - start, value,
+                  attr, 0);
         }
       }
     }

test/mjsunit/regress/regress-783119.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let a = [,,,,,,,,,,,,,,,,,,,,,,,11,12,13,14,15,16,17,18,19];
+%NormalizeElements(a);
+let b = a.slice(19);
+assertEquals(11, b[4]);