Back off normalizing on set length in sync with adding a property

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/elements.h"
 #include "src/messages.h"
@@ skipping 1824 matching lines @@
   ELEMENTS_LIST(ACCESSOR_DELETE)
 #undef ACCESSOR_DELETE
   elements_accessors_ = NULL;
 }
 
 
 template <typename ElementsAccessorSubclass, typename ElementsKindTraits>
 void ElementsAccessorBase<ElementsAccessorSubclass, ElementsKindTraits>::
     SetLengthImpl(Handle<JSArray> array, uint32_t length,
                   Handle<FixedArrayBase> backing_store) {
-  DCHECK(!JSArray::SetLengthWouldNormalize(array->GetHeap(), length));
+  DCHECK(!array->SetLengthWouldNormalize(length));
   DCHECK(IsFastElementsKind(array->GetElementsKind()));
   uint32_t old_length = 0;
   CHECK(array->length()->ToArrayIndex(&old_length));
 
   if (old_length < length) {
     ElementsKind kind = array->GetElementsKind();
     if (!IsFastHoleyElementsKind(kind)) {
       kind = GetHoleyElementsKind(kind);
       JSObject::TransitionElementsKind(array, kind);
     }
@@ skipping 113 matching lines @@
       break;
   }
 
   array->set_elements(*elms);
   array->set_length(Smi::FromInt(number_of_elements));
   return array;
 }
 
 }  // namespace internal
 }  // namespace v8