Version 4.8.2.1 (cherry-pick)

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/elements.h"
 #include "src/factory.h"
@@ skipping 235 matching lines @@
   if (caller_args->length() == 1) {
     Handle<Object> argument_one = caller_args->at<Object>(0);
     if (argument_one->IsSmi()) {
       int value = Handle<Smi>::cast(argument_one)->value();
       if (value < 0 ||
           JSArray::SetLengthWouldNormalize(isolate->heap(), value)) {
         // the array is a dictionary in this case.
         can_use_type_feedback = false;
       } else if (value != 0) {
         holey = true;
-        if (value >= JSArray::kInitialMaxFastElementArray) {
+        if (value >= JSObject::kInitialMaxFastElementArray) {
           can_inline_array_constructor = false;
         }
       }
     } else {
       // Non-smi length argument produces a dictionary
       can_use_type_feedback = false;
     }
   }
 
   Handle<JSArray> array;
@@ skipping 225 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_FastOneByteArrayJoin) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   // Returning undefined means that this fast path fails and one has to resort
   // to a slow path.
   return isolate->heap()->undefined_value();
 }
 }  // namespace internal
 }  // namespace v8