Array() in optimized code can create with wrong ElementsKind in corner cases.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index f9ed74a480a42e74ab7b789d5e34aaa6c98b6845..23fe4cda220288b9b08c28311554838f80335240 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -10406,6 +10406,11 @@ class JSArray: public JSObject {
   // capacity is non-zero.
   static void Initialize(Handle<JSArray> array, int capacity, int length = 0);
 
+  // If the JSArray has fast elements, and new_length would result in
+  // normalization, returns true.
+  static inline bool SetElementsLengthWouldNormalize(
+      Heap* heap, Handle<Object> new_length_handle);
+
   // Initializes the array to a certain length.
   inline bool AllowsSetElementsLength();
   // Can cause GC.