Fix invalid usage of StoreIC_ArrayLength optimization.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 2b18e67c998aaa7251215d9ae24502de01566396..5346585bd3e0aad0e7bcf6b2b49cdc6680ecb315 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1471,7 +1471,6 @@ class JSObject: public JSReceiver {
   inline bool HasExternalDoubleElements();
   bool HasFastArgumentsElements();
   bool HasDictionaryArgumentsElements();
-  inline bool AllowsSetElementsLength();
   inline NumberDictionary* element_dictionary();  // Gets slow elements.
 
   // Requires: HasFastElements().
@@ -1733,9 +1732,6 @@ class JSObject: public JSReceiver {
   bool HasRealElementProperty(uint32_t index);
   bool HasRealNamedCallbackProperty(String* key);
 
-  // Initializes the array to a certain length
-  MUST_USE_RESULT MaybeObject* SetElementsLength(Object* length);
-
   // Get the header size for a JSObject.  Used to compute the index of
   // internal fields as well as the number of internal fields.
   inline int GetHeaderSize();
@@ -7398,6 +7394,10 @@ class JSArray: public JSObject {
   // capacity is non-zero.
   MUST_USE_RESULT MaybeObject* Initialize(int capacity);
 
+  // Initializes the array to a certain length.
+  inline bool AllowsSetElementsLength();
+  MUST_USE_RESULT MaybeObject* SetElementsLength(Object* length);
+
   // Set the content of the array to the content of storage.
   inline MaybeObject* SetContent(FixedArrayBase* storage);