Fix TransitionElementsKindStub to handle non-JSArray objects correctly.

src/code-stubs.h

Index: src/code-stubs.h
diff --git a/src/code-stubs.h b/src/code-stubs.h
index b65f085d3d70711ae4aad75ce9f1ec2bfd2198da..18b9d1391daa26cf1c31ec258f87012dc08cdc28 100644
--- a/src/code-stubs.h
+++ b/src/code-stubs.h
@@ -2047,9 +2047,11 @@ class KeyedStoreFastElementStub : public HydrogenCodeStub {
 class TransitionElementsKindStub : public HydrogenCodeStub {
  public:
   TransitionElementsKindStub(ElementsKind from_kind,
-                             ElementsKind to_kind) {
+                             ElementsKind to_kind,
+                             bool is_js_array) {
     bit_field_ = FromKindBits::encode(from_kind) |
-        ToKindBits::encode(to_kind);
+                 ToKindBits::encode(to_kind) |
+                 IsJSArrayBits::encode(is_js_array);
   }
 
   ElementsKind from_kind() const {
@@ -2060,6 +2062,10 @@ class TransitionElementsKindStub : public HydrogenCodeStub {
     return ToKindBits::decode(bit_field_);
   }
 
+  bool is_js_array() const {
+    return IsJSArrayBits::decode(bit_field_);
+  }
+
   virtual Handle<Code> GenerateCode(Isolate* isolate);
 
   virtual void InitializeInterfaceDescriptor(
@@ -2069,6 +2075,7 @@ class TransitionElementsKindStub : public HydrogenCodeStub {
  private:
   class FromKindBits: public BitField<ElementsKind, 8, 8> {};
   class ToKindBits: public BitField<ElementsKind, 0, 8> {};
+  class IsJSArrayBits: public BitField<bool, 16, 1> {};
   uint32_t bit_field_;
 
   Major MajorKey() { return TransitionElementsKind; }