Version 4.8.2.1 (cherry-pick)

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stubs.h"
 
 #include "src/bailout-reason.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
 #include "src/ic/ic.h"
@@ skipping 1197 matching lines @@
 
 
 HValue* CodeStubGraphBuilderBase::BuildArrayNArgumentsConstructor(
     JSArrayBuilder* array_builder, ElementsKind kind) {
   // Insert a bounds check because the number of arguments might exceed
   // the kInitialMaxFastElementArray limit. This cannot happen for code
   // that was parsed, but calling via Array.apply(thisArg, [...]) might
   // trigger it.
   HValue* length = GetArgumentsLength();
   HConstant* max_alloc_length =
-      Add<HConstant>(JSArray::kInitialMaxFastElementArray);
+      Add<HConstant>(JSObject::kInitialMaxFastElementArray);
   HValue* checked_length = Add<HBoundsCheck>(length, max_alloc_length);
 
   // We need to fill with the hole if it's a smi array in the multi-argument
   // case because we might have to bail out while copying arguments into
   // the array because they aren't compatible with a smi array.
   // If it's a double array, no problem, and if it's fast then no
   // problem either because doubles are boxed.
   //
   // TODO(mvstanton): consider an instruction to memset fill the array
   // with zero in this case instead.
@@ skipping 1123 matching lines @@
   return Pop();
 }
 
 
 Handle<Code> KeyedLoadGenericStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 }  // namespace internal
 }  // namespace v8