Chrome ReduceJSLoadPropertyWithEnumeratedKey Out-Of-Bounds Access

Chrome checks in ReduceJSLoadPropertyWithEnumeratedKey are not sufficient to prevent the engine from reading an out-of-bounds index from an enum cache.