Bugfix: array constructor stub was missing a case

src/x64/code-stubs-x64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 6655 matching lines @@
   Label no_info, switch_ready;
   // Get the elements kind and case on that.
   __ Cmp(rbx, undefined_sentinel);
   __ j(equal, &no_info);
   __ movq(rdx, FieldOperand(rbx, Cell::kValueOffset));
 
   // The type cell may have undefined in its value.
   __ Cmp(rdx, undefined_sentinel);
   __ j(equal, &no_info);
 
-  // We should have an allocation site object
-  if (FLAG_debug_code) {
-    __ Cmp(FieldOperand(rdx, 0),
-           Handle<Map>(masm->isolate()->heap()->allocation_site_map()));
-    __ Assert(equal, "Expected AllocationSite object in register rdx");
-  }
+  // The type cell has either an AllocationSite or a JSFunction
+  __ Cmp(FieldOperand(rdx, 0),
+         Handle<Map>(masm->isolate()->heap()->allocation_site_map()));
+  __ j(not_equal, &no_info);
 
   __ movq(rdx, FieldOperand(rdx, AllocationSite::kPayloadOffset));
   __ SmiToInteger32(rdx, rdx);
   __ jmp(&switch_ready);
   __ bind(&no_info);
   __ movq(rdx, Immediate(GetInitialFastElementsKind()));
   __ bind(&switch_ready);
 
   if (argument_count_ == ANY) {
     Label not_zero_case, not_one_case;
@@ skipping 107 matching lines @@
   __ bind(&fast_elements_case);
   GenerateCase(masm, FAST_ELEMENTS);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64