JSObject::putByIndexBeyondVectorLengthWithoutAttributes needs to go to the sparse...

JSObject::putByIndexBeyondVectorLengthWithoutAttributes needs to go to the sparse map based on MAX_STORAGE_VECTOR_INDEX
https://bugs.webkit.org/show_bug.cgi?id=154201
rdar://problem/24291387

Reviewed by Saam Barati.

I decided against adding a test for this, because it runs for a very long time.

* runtime/JSObject.cpp:
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes): Fix the bug.
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncSplit): Fix a related bug: if this code creates an array that would have
    hit the above bug, then it would probably manifest as a spin or as swapping.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@196524 268f45cc-cd09-0410-ab3c-d52691b4dbfc