Set length only after retrieving the element succeeded

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 655 matching lines @@
 
   if (FLAG_harmony_observation && array->map()->is_observed()) {
     return CallJsBuiltin(isolate, "ArrayPop", args);
   }
 
   int len = Smi::cast(array->length())->value();
   if (len == 0) return heap->undefined_value();
 
   ElementsAccessor* accessor = array->GetElementsAccessor();
   int new_length = len - 1;
-  Object* result;
-  MaybeObject* maybe_result = accessor->Get(array, array, new_length);
-  if (!maybe_result->To(&result)) return maybe_result;
+  MaybeObject* maybe_result;
+  if (accessor->HasElement(array, array, new_length, elms_obj)) {
+    maybe_result = accessor->Get(array, array, new_length, elms_obj);
+  } else {
+    maybe_result = array->GetPrototype()->GetElement(len - 1);
+  }
+  if (maybe_result->IsFailure()) return maybe_result;
   MaybeObject* maybe_failure =
       accessor->SetLength(array, Smi::FromInt(new_length));
   if (maybe_failure->IsFailure()) return maybe_failure;
-  if (!result->IsTheHole()) return result;
-  return array->GetPrototype()->GetElement(len - 1);
+  return maybe_result;
 }
 
 
 BUILTIN(ArrayShift) {
   Heap* heap = isolate->heap();
   Object* receiver = *args.receiver();
   FixedArrayBase* elms_obj;
   MaybeObject* maybe_elms_obj =
       EnsureJSArrayWithWritableFastElements(heap, receiver, NULL, 0);
   if (maybe_elms_obj == NULL)
@@ skipping 1221 matching lines @@
   return Handle<Code>(code_address);                        \
 }
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 } }  // namespace v8::internal