making heap verification more aggressive

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
@@ skipping 716 matching lines @@
     indices.Add(subject_length, zone_scope.zone());
   }
 
   // The list indices now contains the end of each part to create.
 
   // Create JSArray of substrings separated by separator.
   int part_count = indices.length();
 
   Handle<JSArray> result =
       isolate->factory()->NewJSArray(FAST_ELEMENTS, part_count, part_count,
-                                     INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE);
+                                     INITIALIZE_ARRAY_ELEMENTS_WITH_UNDEFINED);
 
   DCHECK(result->HasFastObjectElements());
 
   Handle<FixedArray> elements(FixedArray::cast(result->elements()));
 
   if (part_count == 1 && indices.at(0) == subject_length) {
     elements->set(0, *subject);
   } else {
     int part_start = 0;
     FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < part_count, i++, {
@@ skipping 268 matching lines @@
 
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 }  // namespace internal
 }  // namespace v8