Array() in optimized code can create with wrong ElementsKind in corner cases.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index e5e8235c292a15049f7afffd4ca0d0b9b9eb85fb..f284f65d34efaa93b7efaedaf5d1c7d93cc84c9e 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -7201,6 +7201,17 @@ void JSArray::set_length(Smi* length) {
 }
 
 
+bool JSArray::SetElementsLengthWouldNormalize(
+    Heap* heap, Handle<Object> new_length_handle) {
+  // If the new array won't fit in a some non-trivial fraction of the max old
+  // space size, then force it to go dictionary mode.
+  int max_fast_array_size =
+      static_cast<int>((heap->MaxOldGenerationSize() / kDoubleSize) / 4);
+  return new_length_handle->IsNumber() &&
+         NumberToInt32(*new_length_handle) >= max_fast_array_size;
+}
+
+
 bool JSArray::AllowsSetElementsLength() {
   bool result = elements()->IsFixedArray() || elements()->IsFixedDoubleArray();
   DCHECK(result == !HasExternalArrayElements());