Object.observe: prevent observed objects from using fast elements.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 06a8458549104a088925775540e4a10e38d05c5a..dfb4245954a3ef61a652720dc300d19d10fe48d3 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -13384,6 +13384,13 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_SetIsObserved) {
     if (!maybe->To(&map)) return maybe;
     map->set_is_observed(is_observed);
     obj->set_map(map);
+    if (is_observed && obj->IsJSObject() &&
+        !JSObject::cast(obj)->HasExternalArrayElements()) {
+      // Go to dictionary mode, so that we don't skip map checks.
+      maybe = JSObject::cast(obj)->NormalizeElements();
+      if (maybe->IsFailure()) return maybe;
+      ASSERT(!JSObject::cast(obj)->HasFastElements());
+    }
   }
   return isolate->heap()->undefined_value();
 }