A JSArray may have a filler map in the elements pointer.

A JSArray may have a filler map in the elements pointer.

We already have code that expects this, but incorrectly asserted that the
filler map case would never happen when allocation folding is turned on.
However, even folding has it's limits, bailing out of continued folding
when the object size grows too large. Therefore, it's a general problem
when verifying JSArray objects, that we might encounter a filler map
in elements().

Discovered by ClusterFuzz crbug 347903.

R=hpayer@chromium.org
LOG=N
BUG=347903
Committed: https://code.google.com/p/v8/source/detail?r=19604

[Hannes Payer (out of office), 2014-02-28 12:24:21]

lgtm, one comment nit

https://codereview.chromium.org/184493002/diff/1/test/mjsunit/regress/regress...
File test/mjsunit/regress/regress-crbug-347903.js (right):

https://codereview.chromium.org/184493002/diff/1/test/mjsunit/regress/regress...
test/mjsunit/regress/regress-crbug-347903.js:10: // __v_14.
fix comment, __v_14

[mvstanton, 2014-02-28 12:29:26]

Committed patchset #2 manually as r19604 (tree was closed).