Ensure large Smi-only arrays don't transition to FAST_DOUBLE_ARRAY

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 5346585bd3e0aad0e7bcf6b2b49cdc6680ecb315..912cd21ab2abf47d3cf95ad8cbaea0213ec8a1ff 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1644,8 +1644,9 @@ class JSObject: public JSReceiver {
   // elements.
   bool ShouldConvertToFastElements();
   // Returns true if the elements of JSObject contains only values that can be
-  // represented in a FixedDoubleArray.
-  bool CanConvertToFastDoubleElements();
+  // represented in a FixedDoubleArray and has at least one value that can only
+  // be represented as a double and not a Smi.
+  bool ShouldConvertToFastDoubleElements(bool* has_smi_only_elements);
 
   // Tells whether the index'th element is present.
   bool HasElementWithReceiver(JSReceiver* receiver, uint32_t index);
@@ -1708,6 +1709,7 @@ class JSObject: public JSReceiver {
 
   enum SetFastElementsCapacityMode {
     kAllowSmiOnlyElements,
+    kForceSmiOnlyElements,
     kDontAllowSmiOnlyElements
   };