Support Smi->Double->HeapObject transitions in constructed Arrays.

src/elements.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 26 matching lines @@
 // ElementsKinds.
 class ElementsAccessor {
  public:
   ElementsAccessor() { }
   virtual ~ElementsAccessor() { }
   virtual MaybeObject* Get(FixedArrayBase* backing_store,
                            uint32_t key,
                            JSObject* holder,
                            Object* receiver) = 0;
 
-  // Modifies the length data property as specified for JSArrays and resizes
-  // the underlying backing store accordingly.
+  // Modifies the length data property as specified for JSArrays and resizes the
+  // underlying backing store accordingly. The method honors the semantics of
+  // changing array sizes as defined in EcmaScript 5.1 15.4.5.2, i.e. array that
+  // have non-deletable elements can only be shrunk to the size of highest
+  // element that is non-deletable.
   virtual MaybeObject* SetLength(JSObject* holder,
                                  Object* new_length) = 0;
 
+  // Modifies both the length and capacity of a JSArray, resizing the underlying
+  // backing store as necessary. This method does NOT honor the semantics of
+  // EcmaScript 5.1 15.4.5.2, arrays can be shrunk beyond non-deletable
+  // elements. This method should only be called for array expansion OR by
+  // runtime JavaScript code that use InternalArrays and don't care about
+  // EcmaScript 5.1 semantics.
+  virtual MaybeObject* SetCapacityAndLength(JSArray* array,
+                                            int capacity,
+                                            int length) = 0;
+
   virtual MaybeObject* Delete(JSObject* holder,
                               uint32_t key,
                               JSReceiver::DeleteMode mode) = 0;
 
   virtual MaybeObject* AddElementsToFixedArray(FixedArrayBase* from,
                                                FixedArray* to,
                                                JSObject* holder,
                                                Object* receiver) = 0;
 
   // Returns a shared ElementsAccessor for the specified ElementsKind.
@@ skipping 29 matching lines @@
 
  private:
   static ElementsAccessor** elements_accessors_;
 
   DISALLOW_COPY_AND_ASSIGN(ElementsAccessor);
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_ELEMENTS_H_