[runtime] %GrowArrayElements doesn't have a native context in TurboFan.

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/code-stubs.h"
 #include "src/conversions-inl.h"
 #include "src/elements.h"
@@ skipping 356 matching lines @@
   CONVERT_NUMBER_CHECKED(int, key, Int32, args[1]);
 
   if (key < 0) {
     return object->elements();
   }
 
   uint32_t capacity = static_cast<uint32_t>(object->elements()->length());
   uint32_t index = static_cast<uint32_t>(key);
 
   if (index >= capacity) {
-    if (object->WouldConvertToSlowElements(index)) {
+    if (object->map()->is_prototype_map() ||
+        object->WouldConvertToSlowElements(index)) {
       // We don't want to allow operations that cause lazy deopt. Return a Smi
       // as a signal that optimized code should eagerly deoptimize.
       return Smi::FromInt(0);
     }
 
     uint32_t new_capacity = JSObject::NewElementsCapacity(index + 1);
     object->GetElementsAccessor()->GrowCapacityAndConvert(object, new_capacity);
   }
 
   // On success, return the fixed array elements.
@@ skipping 150 matching lines @@
     // If SameValueZero(searchElement, elementK) is true, return true.
     if (search_element->SameValueZero(*element_k)) {
       return isolate->heap()->true_value();
     }
   }
   return isolate->heap()->false_value();
 }
 
 }  // namespace internal
 }  // namespace v8