Correct handling of arrays with callbacks in the prototype chain.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 006aff394c20cd517c516e0823424f3aa42c9c80..651acc160b501b3ff849740e51f4e804d9715c2f 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -4287,6 +4287,30 @@ uint32_t Map::bit_field3() {
 }
 
 
+void Map::set_bit_field4(uint32_t bits) {
+  // Ensure the upper 2 bits have the same value by sign extending it. This is
+  // necessary to be able to use the 31st bit.
+  int value = bits << 1;
+  WRITE_FIELD(this, kBitField4Offset, Smi::FromInt(value >> 1));
+}
+
+
+uint32_t Map::bit_field4() {
+  Object* value = READ_FIELD(this, kBitField4Offset);
+  return Smi::cast(value)->value();
+}
+
+
+void Map::set_has_element_callbacks(bool value) {
+  set_bit_field4(HasElementCallbacks::update(bit_field4(), value));
+}
+
+
+bool Map::has_element_callbacks() {
+  return HasElementCallbacks::decode(bit_field4());
+}
+
+
 void Map::ClearTransitions(Heap* heap, WriteBarrierMode mode) {
   Object* back_pointer = GetBackPointer();