Fix pixel array support for x64 and make the fast Array functions...

src/x64/stub-cache-x64.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 115 matching lines @@
                                           Context::BOOLEAN_FUNCTION_INDEX,
                                           rcx);
       CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder,
                       rbx, rdx, name, &miss);
       break;
     }
 
     case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
       CheckPrototypes(JSObject::cast(object), rdx, holder,
                       rbx, rcx, name, &miss);
-      // Make sure object->elements()->map() != Heap::dictionary_array_map()
+      // Make sure object->HasFastElements().
       // Get the elements array of the object.
       __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
       // Check that the object is in fast mode (not dictionary).
       __ Cmp(FieldOperand(rbx, HeapObject::kMapOffset),
-             Factory::hash_table_map());
-      __ j(equal, &miss);
+             Factory::fixed_array_map());
+      __ j(not_equal, &miss);
       break;
 
     default:
       UNREACHABLE();
   }
 
   // Get the function and setup the context.
   __ Move(rdi, Handle<JSFunction>(function));
   __ movq(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
 
@@ skipping 744 matching lines @@
 
   // Return the value (register rax).
   __ ret(0);
 }
 
 
 #undef __
 
 
 } }  // namespace v8::internal