Correct handling of arrays with callbacks in the prototype chain.

src/heap.cc

Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index fa358c53929127218fbd4fd719d5bec8d3bab3b0..aea2f1d0df2c69e1baf113d023d665ab2915ea4e 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -467,6 +467,21 @@ intptr_t Heap::SizeOfObjects() {
 }
 
 
+void Heap::ClearAllICsByKind(Code::Kind kind) {
+  HeapObjectIterator it(code_space());
+
+  for (Object* object = it.Next(); object != NULL; object = it.Next()) {
+    Code* code = Code::cast(object);
+    Code::Kind current_kind = code->kind();
+    // TODO(mvstanton): are these kinds enough?
+    if (current_kind == Code::FUNCTION ||
+        current_kind == Code::OPTIMIZED_FUNCTION) {
+      code->ClearInlineCaches(kind);
+    }
+  }
+}
+
+
 void Heap::RepairFreeListsAfterBoot() {
   PagedSpaces spaces(this);
   for (PagedSpace* space = spaces.next();
@@ -2453,6 +2468,7 @@ MaybeObject* Heap::AllocatePartialMap(InstanceType instance_type,
   int bit_field3 = Map::EnumLengthBits::encode(Map::kInvalidEnumCache) |
                    Map::OwnsDescriptors::encode(true);
   reinterpret_cast<Map*>(result)->set_bit_field3(bit_field3);
+  reinterpret_cast<Map*>(result)->set_bit_field4(0);
   return result;
 }
 
@@ -2486,6 +2502,7 @@ MaybeObject* Heap::AllocateMap(InstanceType instance_type,
                    Map::OwnsDescriptors::encode(true);
   map->set_bit_field3(bit_field3);
   map->set_elements_kind(elements_kind);
+  map->set_bit_field4(0);
 
   return map;
 }
@@ -3289,6 +3306,11 @@ bool Heap::CreateInitialObjects() {
   }
   set_elements_transition_symbol(Symbol::cast(obj));
 
+  { MaybeObject* maybe_obj = AllocateSymbol();
+    if (!maybe_obj->ToObject(&obj)) return false;
+  }
+  set_element_callbacks_symbol(Symbol::cast(obj));
+
   { MaybeObject* maybe_obj = SeededNumberDictionary::Allocate(this, 0, TENURED);
     if (!maybe_obj->ToObject(&obj)) return false;
   }