Object.observe: prevent observed objects from using fast elements.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index b25af33c77a59d14f2d92a40b422297242c9cc90..53e12b2f043e71a89fbbdcd0b5c8b3a5a43e8866 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -1426,6 +1426,13 @@ MaybeObject* JSObject::ResetElements() {
   if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   set_map(Map::cast(obj));
   initialize_elements();
+  if (FLAG_harmony_observation && map()->is_observed()) {
+    // Maintain invariant that observed elements are always in dictionary mode.
+    // For this to work on arrays, we have to make sure to reset length first.
+    if (IsJSArray()) JSArray::cast(this)->set_length(Smi::FromInt(0));
+    maybe_obj = NormalizeElements();
+    if (maybe_obj->IsFailure()) return maybe_obj;
+  }
   return this;
 }