Correct handling of arrays with callbacks in the prototype chain.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index d9d36e0f4be1147ad8d5e3eee2c9625f6b024c1e..ca17a7bf6bc8f64162c15728d379645a957fc666 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -4287,6 +4287,30 @@ uint32_t Map::bit_field3() {
 }
 
 
+void Map::set_bit_field4(uint32_t bits) {
+  // Ensure the upper 2 bits have the same value by sign extending it. This is
+  // necessary to be able to use the 31st bit.
+  int value = bits << 1;
+  WRITE_FIELD(this, kBitField4Offset, Smi::FromInt(value >> 1));
+}
+
+
+uint32_t Map::bit_field4() {
+  Object* value = READ_FIELD(this, kBitField4Offset);
+  return Smi::cast(value)->value();
+}
+
+
+void Map::set_has_element_callbacks(bool value) {
+  set_bit_field4(HasElementCallbacks::update(bit_field4(), value));
+}
+
+
+bool Map::has_element_callbacks() {
+  return HasElementCallbacks::decode(bit_field4());
+}
+
+
 void Map::ClearTransitions(Heap* heap, WriteBarrierMode mode) {
   Object* back_pointer = GetBackPointer();
 
@@ -4326,6 +4350,11 @@ bool Map::HasElementsTransition() {
 }
 
 
+bool Map::HasElementCallbacksTransition() {
+  return HasTransitionArray() && transitions()->HasElementCallbacksTransition();
+}
+
+
 bool Map::HasTransitionArray() {
   Object* object = READ_FIELD(this, kTransitionsOrBackPointerOffset);
   return object->IsTransitionArray();
@@ -4376,6 +4405,18 @@ MaybeObject* Map::set_elements_transition_map(Map* transitioned_map) {
 }
 
 
+MaybeObject* Map::set_element_callbacks_map(Map* callback_map) {
+  TransitionArray* transitions;
+  MaybeObject* maybe_transitions = AddTransition(
+      GetHeap()->element_callbacks_symbol(),
+      callback_map,
+      FULL_TRANSITION);
+  if (!maybe_transitions->To(&transitions)) return maybe_transitions;
+  set_transitions(transitions);
+  return transitions;
+}
+
+
 FixedArray* Map::GetPrototypeTransitions() {
   if (!HasTransitionArray()) return GetHeap()->empty_fixed_array();
   if (!transitions()->HasPrototypeTransitions()) {
@@ -5584,6 +5625,22 @@ bool JSObject::HasNonStrictArgumentsElements() {
 }
 
 
+bool JSObject::HasNonStrictArgumentsElementsMap() {
+  return elements()->map() == GetHeap()->non_strict_arguments_elements_map();
+}
+
+
+
+FixedArrayBase* JSObject::GetElements() {
+  // Find the backing store.
+  FixedArrayBase* array = FixedArrayBase::cast(elements());
+  if (HasNonStrictArgumentsElementsMap()) {
+    array = FixedArrayBase::cast(FixedArray::cast(array)->get(1));
+  }
+  return array;
+}
+
+
 bool JSObject::HasExternalArrayElements() {
   HeapObject* array = elements();
   ASSERT(array != NULL);