Use atomic operation to read the length of a fixed array.

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/conversions.h"
 #include "src/isolate-inl.h"
@@ skipping 1902 matching lines @@
   }
 
   // In order to keep heap in consistent state there must be no allocations
   // before object re-initialization is finished and filler object is installed.
   DisallowHeapAllocation no_allocation;
 
   // Put in filler if the new object is smaller than the old.
   if (size_difference > 0) {
     Address address = proxy->address();
     heap->CreateFillerObjectAt(address + map->instance_size(), size_difference);
-    heap->AdjustLiveBytes(address, -size_difference, Heap::FROM_MUTATOR);
+    heap->AdjustLiveBytes(address, -size_difference, Heap::SWEEPING_STARTED);
   }
 
   // Reset the map for the object.
   proxy->synchronized_set_map(*map);
   Handle<JSObject> jsobj = Handle<JSObject>::cast(proxy);
 
   // Reinitialize the object from the constructor map.
   heap->InitializeJSObjectFromMap(*jsobj, *properties, *map);
 
   // The current native context is used to set up certain bits.
@@ skipping 382 matching lines @@
   return Handle<Object>::null();
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 } }  // namespace v8::internal