fix reconfigure of indexed integer exotic objects

R=verwaest@chromium.org
BUG=466084
LOG=N

Review URL: https://codereview.chromium.org/1037213002

Cr-Commit-Position: refs/heads/master@{#27498}

src/objects.cc

@@ -4162,6 +4162,8 @@ MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes(
   for (; it.IsFound(); it.Next()) {
     switch (it.state()) {
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
+        return value;
+
       case LookupIterator::INTERCEPTOR:
       case LookupIterator::JSPROXY:
       case LookupIterator::NOT_FOUND:

test/mjsunit/es6/indexed-integer-exotics.js

@@ -54,3 +54,10 @@ for (var i = 0; i < 3; i++) {
 }
 %OptimizeFunctionOnNextCall(f);
 assertEquals(undefined, f());
+
+Object.defineProperty(new Int32Array(), "-1", {'value': 1});
+Object.defineProperty(new Int32Array(), "-0", {'value': 1});
+Object.defineProperty(new Int32Array(), "-10", {'value': 1});
+Object.defineProperty(new Int32Array(), "4294967296", {'value': 1});
+
+check();