Version 4.8.271.13 (cherry-pick)

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 715ecfb60a5fd5deb1d967449f8b38aab7385036..bb32e451b57f6603e038c78e1e6a58b3908cdcb4 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -1235,13 +1235,18 @@ class FastElementsAccessor
       }
       int num_used = 0;
       for (int i = 0; i < backing_store->length(); ++i) {
-        if (!backing_store->is_the_hole(i)) ++num_used;
-        // Bail out early if more than 1/4 is used.
-        if (4 * num_used > backing_store->length()) break;
-      }
-      if (4 * num_used <= backing_store->length()) {
-        JSObject::NormalizeElements(obj);
+        if (!backing_store->is_the_hole(i)) {
+          ++num_used;
+          // Bail out if a number dictionary wouldn't be able to save at least
+          // 75% space.
+          if (4 * SeededNumberDictionary::ComputeCapacity(num_used) *
+                  SeededNumberDictionary::kEntrySize >
+              backing_store->length()) {
+            return;
+          }
+        }
       }
+      JSObject::NormalizeElements(obj);
     }
   }