Initialize elements pointer in BuildCloneShallowArray when allocation folding is turned off.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 80eff3b552f86cfdaeb9eec6ee3e44320a135b81..a1feeb9041bd727bda760c7be7d79b887d9269c9 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2619,6 +2619,15 @@ HValue* HGraphBuilder::BuildCloneShallowArray(HValue* boilerplate,
         object, Add<HConstant>(JSArray::kSize), allocation_site);
   }
 
+  // We have to initialize the elements pointer if allocation folding is
+  // turned off.
+  if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
+    HConstant* empty_fixed_array = Add<HConstant>(
+        isolate()->factory()->empty_fixed_array());
+    Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
+        empty_fixed_array, INITIALIZING_STORE);
+  }
+
   if (length > 0) {
     HValue* boilerplate_elements = AddLoadElements(boilerplate);
     HValue* object_elements;