Correct handling of arrays with callbacks in the prototype chain.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1994 matching lines @@
   // Retrieves a permanent object identity hash code. The undefined value might
   // be returned in case no hash was created yet and OMIT_CREATION was used.
   inline MUST_USE_RESULT MaybeObject* GetIdentityHash(CreationFlag flag);
 
   // Lookup a property.  If found, the result is valid and has
   // detailed information.
   void LocalLookup(Name* name, LookupResult* result,
                    bool search_hidden_prototypes = false);
   void Lookup(Name* name, LookupResult* result);
 
+  bool MayHaveIndexedCallbacksInPrototypeChain();
+
  protected:
   Smi* GenerateIdentityHash();
 
   static Handle<Object> SetPropertyWithDefinedSetter(Handle<JSReceiver> object,
                                                      Handle<JSReceiver> setter,
                                                      Handle<Object> value);
 
  private:
   PropertyAttributes GetPropertyAttributeForResult(JSReceiver* receiver,
                                                    LookupResult* result,
@@ skipping 3259 matching lines @@
   int CodeSize() { return SizeFor(body_size()); }
   inline void CodeIterateBody(ObjectVisitor* v);
 
   template<typename StaticVisitor>
   inline void CodeIterateBody(Heap* heap);
 
   DECLARE_PRINTER(Code)
   DECLARE_VERIFIER(Code)
 
   void ClearInlineCaches();
+  void ClearInlineCaches(Kind* kind);
+  void ClearInlineCaches(Kind kind);
+
   void ClearTypeFeedbackCells(Heap* heap);
 
   BailoutId TranslatePcOffsetToAstId(uint32_t pc_offset);
 
 #define DECLARE_CODE_AGE_ENUM(X) k##X##CodeAge,
   enum Age {
     kNoAge = 0,
     CODE_AGE_LIST(DECLARE_CODE_AGE_ENUM)
     kAfterLastCodeAge,
     kLastCodeAge = kAfterLastCodeAge - 1,
@@ skipping 304 matching lines @@
   class IsShared:                   public BitField<bool, 22,  1> {};
   class FunctionWithPrototype:      public BitField<bool, 23,  1> {};
   class DictionaryMap:              public BitField<bool, 24,  1> {};
   class OwnsDescriptors:            public BitField<bool, 25,  1> {};
   class IsObserved:                 public BitField<bool, 26,  1> {};
   class Deprecated:                 public BitField<bool, 27,  1> {};
   class IsFrozen:                   public BitField<bool, 28,  1> {};
   class IsUnstable:                 public BitField<bool, 29,  1> {};
   class IsMigrationTarget:          public BitField<bool, 30,  1> {};
 
+  // Bit field 4.
+  inline uint32_t bit_field4();
+  inline void set_bit_field4(uint32_t bits);
+
+  class HasElementCallbacks:        public BitField<int,   0,  1> {};
+
+  inline void set_has_element_callbacks(bool value);
+  inline bool has_element_callbacks();
+
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
   // property is set to a value that is not a JSObject, the prototype
   // property will not be used to create instances of the function.
   // See ECMA-262, 13.2.2.
   inline void set_non_instance_prototype(bool value);
   inline bool has_non_instance_prototype();
 
   // Tells whether function has special prototype property. If not, prototype
   // property will not be created when accessed (will return undefined),
@@ skipping 534 matching lines @@
   // pointer if unused. When the map has transitions, the back pointer is
   // transferred to the transition array and accessed through an extra
   // indirection.
   static const int kTransitionsOrBackPointerOffset =
       kConstructorOffset + kPointerSize;
   static const int kDescriptorsOffset =
       kTransitionsOrBackPointerOffset + kPointerSize;
   static const int kCodeCacheOffset = kDescriptorsOffset + kPointerSize;
   static const int kDependentCodeOffset = kCodeCacheOffset + kPointerSize;
   static const int kBitField3Offset = kDependentCodeOffset + kPointerSize;
-  static const int kSize = kBitField3Offset + kPointerSize;
+  static const int kBitField4Offset = kBitField3Offset + kPointerSize;
+  static const int kSize = kBitField4Offset + kPointerSize;
 
   // Layout of pointer fields. Heap iteration code relies on them
   // being continuously allocated.
   static const int kPointerFieldsBeginOffset = Map::kPrototypeOffset;
   static const int kPointerFieldsEndOffset = kBitField3Offset + kPointerSize;
 
   // Byte offsets within kInstanceSizesOffset.
   static const int kInstanceSizeOffset = kInstanceSizesOffset + 0;
   static const int kInObjectPropertiesByte = 1;
   static const int kInObjectPropertiesOffset =
@@ skipping 4238 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_