v8-issue-553623004. Crash while building.

gistfile1.txt

From 453bae509cece509a70157b66ab2b5a62bd21deb Mon Sep 17 00:00:00 2001
From: Diego Pino Garcia <dpino@igalia.com>
Date: Wed, 10 Dec 2014 15:59:09 +0100
Subject: [PATCH] Redefine ToLengthFlagged

---
 src/array.js         | 5 +++--
 src/harmony-array.js | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/array.js b/src/array.js
index c702d8c..7d2a2c8 100644
--- a/src/array.js
+++ b/src/array.js
@@ -10,6 +10,8 @@
 
 // -------------------------------------------------------------------
 
+var ToLengthFlagged = TO_UINT32;
+
 // Global list of arrays visited during toString, toLocaleString and
 // join invocations.
 var visited_arrays = new InternalArray();
@@ -366,11 +368,10 @@ function ArrayToString() {
   return %_CallFunction(array, func);
 }
 
-
 function ArrayToLocaleString() {
   var array = ToObject(this);
   var arrayLen = array.length;
-  var len = TO_UINT32(arrayLen);
+  var len = ToLengthFlagged(arrayLen);
   if (len === 0) return "";
   return Join(array, len, ',', ConvertToLocaleString);
 }
diff --git a/src/harmony-array.js b/src/harmony-array.js
index 06fada7..a04d6ee 100644
--- a/src/harmony-array.js
+++ b/src/harmony-array.js
@@ -10,6 +10,8 @@
 
 // -------------------------------------------------------------------
 
+ToLengthFlagged = ToLength;
+
 // ES6 draft 07-15-13, section 15.4.3.23
 function ArrayFind(predicate /* thisArg */) {  // length == 1
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.find");
-- 
1.9.1

You may want to assign ToLengthFlagged after %CheckIsBootstrapping(); but I'm not sure this would make a difference