Fix invalid array length check in TransitionElementsKindStub.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 523 matching lines @@
 
   HValue* js_array = GetParameter(0);
   HValue* map = GetParameter(1);
 
   info()->MarkAsSavesCallerDoubles();
 
   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
     Add<HTrapAllocationMemento>(js_array);
   }
 
-  HInstruction* array_length =
-      AddLoad(js_array, HObjectAccess::ForArrayLength());
-  array_length->set_type(HType::Smi());
+  HInstruction* elements = AddLoadElements(js_array);
+
+  HInstruction* empty_fixed_array = Add<HConstant>(
+      isolate()->factory()->empty_fixed_array(), Representation::Tagged());
 
   IfBuilder if_builder(this);
 
-  if_builder.IfNot<HCompareNumericAndBranch>(array_length,
-                                             graph()->GetConstant0(),
-                                             Token::EQ);
+  if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
+
   if_builder.Then();
 
-  HInstruction* elements = AddLoadElements(js_array);
+  HInstruction* elements_length = AddLoadFixedArrayLength(elements);
 
-  HInstruction* elements_length = AddLoadFixedArrayLength(elements);
+  HInstruction* array_length = AddLoad(
+      js_array, HObjectAccess::ForArrayLength(), NULL, Representation::Smi());
+  array_length->set_type(HType::Smi());
 
   BuildGrowElementsCapacity(js_array, elements, from_kind, to_kind,
                             array_length, elements_length);
 
   if_builder.End();
 
   AddStore(js_array, HObjectAccess::ForMap(), map);
 
   return js_array;
 }
@@ skipping 334 matching lines @@
   return value;
 }
 
 
 Handle<Code> StoreGlobalStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 
 } }  // namespace v8::internal