The Array function must be looked up in the native context.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 2f3df9e22a6b2b212c904b2e2198ec2f2fe47b1c..55d19e05b264910d35bbc57202d55e7e46be7aa2 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -8225,15 +8225,14 @@ static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
 
 
 bool HOptimizedGraphBuilder::IsCallNewArrayInlineable(CallNew* expr) {
-  Handle<AllocationSite> site = expr->allocation_site();
-  if (site.is_null()) return false;
-
   Handle<JSFunction> caller = current_info()->closure();
   Handle<JSFunction> target(isolate()->native_context()->array_function(),
                             isolate());
   int argument_count = expr->arguments()->length();
   // We should have the function plus array arguments on the environment stack.
   ASSERT(environment()->length() >= (argument_count + 1));
+  Handle<AllocationSite> site = expr->allocation_site();
+  ASSERT(!site.is_null());
 
   bool inline_ok = false;
   if (site->CanInlineCall()) {