Apparently the typecheck was necessary for the int case as well.

Cellule · Cellule · commit 30bd6a86fcfe · 2016-05-03T17:54:23.000-07:00
I decided to accept only TaggedInt and thus removing the need to check for MissingItem
diff --git a/lib/Runtime/Language/JavascriptOperators.cpp b/lib/Runtime/Language/JavascriptOperators.cpp
@@ -4685,12 +4685,12 @@ namespace Js
                 }
                 else if (instanceType == TypeIds_NativeIntArray)
                 {
-                    int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);
-                    // Special case for missing item
-                    if (SparseArraySegment<int32>::IsMissingItem(&intValue))
+                    // Only accept tagged int. Also covers case for MissingItem
+                    if (!TaggedInt::Is(value))
                     {
                         return false;
                     }
+                    int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);
                     returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, intValue);
                 }
                 else

Original file line number	Diff line number	Diff line change
`@@ -4685,12 +4685,12 @@ namespace Js`
`4685`	`4685`	`}`
`4686`	`4686`	`else if (instanceType == TypeIds_NativeIntArray)`
`4687`	`4687`	`{`
`4688`		`- int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);`
`4689`		`- // Special case for missing item`
`4690`		`- if (SparseArraySegment<int32>::IsMissingItem(&intValue))`
	`4688`	`+ // Only accept tagged int. Also covers case for MissingItem`
	`4689`	`+ if (!TaggedInt::Is(value))`
`4691`	`4690`	`{`
`4692`	`4691`	`return false;`
`4693`	`4692`	`}`
	`4693`	`+ int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);`
`4694`	`4694`	`returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, intValue);`
`4695`	`4695`	`}`
`4696`	`4696`	`else`