Array() in optimized code can create with wrong ElementsKind in corner cases.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index e5e8235c292a15049f7afffd4ca0d0b9b9eb85fb..347597b5af8e7a52ae49fad9144f696eba5eaa69 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -7201,6 +7201,20 @@ void JSArray::set_length(Smi* length) {
 }
 
 
+bool JSArray::SetElementsLengthWouldNormalize(
+    Heap* heap, Handle<Object> new_length_handle) {
+  // If the new array won't fit in a some non-trivial fraction of the max old
+  // space size, then force it to go dictionary mode.
+  int max_fast_array_size =
+      static_cast<int>((heap->MaxOldGenerationSize() / kDoubleSize) / 4);
+  if (new_length_handle->IsNumber() &&

[Toon Verwaest, 2015/04/15 12:56:23]

return new_length_handle->IsNumber() && NumberToInt32(*new_length_handle) >=
max_fast_array_size ;)

[mvstanton, 2015/04/15 14:10:34]

Done.

+      NumberToInt32(*new_length_handle) >= max_fast_array_size) {
+    return true;
+  }
+  return false;
+}
+
+
 bool JSArray::AllowsSetElementsLength() {
   bool result = elements()->IsFixedArray() || elements()->IsFixedDoubleArray();
   DCHECK(result == !HasExternalArrayElements());