Fix mix-up in HasEnumerableElements()

Fix mix-up in HasEnumerableElements()

Only JSArrays ever have packed elements; holey elements can be on any kind of object.

BUG=chromium:568525
LOG=n
R=cbruni@chromium.org

Committed: https://crrev.com/989f44f126f994bb8df6c49ab09ae7ab99fdc72c
Cr-Commit-Position: refs/heads/master@{#32755}

[Camillo Bruni, 2015-12-10 14:30:07]

lgtm

[Jakob Kummerow, 2015-12-10 14:30:19]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2015-12-10 14:30:22]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1515963002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1515963002/1

[commit-bot: I haz the power, 2015-12-10 15:01:32]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-12-10 15:01:58]

Description was changed from

==========
Fix mix-up in HasEnumerableElements()

Only JSArrays ever have packed elements; holey elements can be on any kind of
object.

BUG=chromium:568525
LOG=n
R=cbruni@chromium.org
==========

to

==========
Fix mix-up in HasEnumerableElements()

Only JSArrays ever have packed elements; holey elements can be on any kind of
object.

BUG=chromium:568525
LOG=n
R=cbruni@chromium.org

Committed: https://crrev.com/989f44f126f994bb8df6c49ab09ae7ab99fdc72c
Cr-Commit-Position: refs/heads/master@{#32755}
==========

[commit-bot: I haz the power, 2015-12-10 15:01:58]

Patchset 1 (id:??) landed as
https://crrev.com/989f44f126f994bb8df6c49ab09ae7ab99fdc72c
Cr-Commit-Position: refs/heads/master@{#32755}

[Toon Verwaest, 2015-12-10 21:15:54]

verwaest@chromium.org changed reviewers:
+ bmeurer@chromium.org, verwaest@chromium.org

[Toon Verwaest, 2015-12-10 21:15:54]

https://codereview.chromium.org/1515963002/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1515963002/diff/1/src/objects.cc#newcode7989
src/objects.cc:7989: int length =
Smi::cast(JSArray::cast(object)->length())->value();
This is not guaranteed; sloppy argument objects are not jsarrays but can be
packed.

[Jakob Kummerow, 2015-12-11 09:47:24]

https://codereview.chromium.org/1515963002/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1515963002/diff/1/src/objects.cc#newcode7989
src/objects.cc:7989: int length =
Smi::cast(JSArray::cast(object)->length())->value();
On 2015/12/10 21:15:54, Toon Verwaest wrote:
> This is not guaranteed; sloppy argument objects are not jsarrays but can be
> packed.

Thanks -> https://codereview.chromium.org/1517073003/