Fix bug in Array.prototype.indexOf/lastIndexOf when called on non-sparse non-arrays.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index f9c2e5bea6995953adc9f7cd1e720d337da3b37d..c9f6928fe7e57fc2d813b970fc5d54593da2aa18 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -7982,15 +7982,17 @@ static Object* Runtime_MoveArrayContents(Arguments args) {
 }
 
 
-// How many elements does this array have?
+// How many elements does this object/array have?
 static Object* Runtime_EstimateNumberOfElements(Arguments args) {
   ASSERT(args.length() == 1);
-  CONVERT_CHECKED(JSArray, array, args[0]);
-  HeapObject* elements = array->elements();
+  CONVERT_CHECKED(JSObject, object, args[0]);
+  HeapObject* elements = object->elements();
   if (elements->IsDictionary()) {
     return Smi::FromInt(NumberDictionary::cast(elements)->NumberOfElements());
+  } else if (object->IsJSArray()) {
+    return JSArray::cast(object)->length();
   } else {
-    return array->length();
+    return Smi::FromInt(FixedArray::cast(elements)->length());
   }
 }