Correct handling of arrays with callbacks in the prototype chain.

src/arm/macro-assembler-arm.cc

Index: src/arm/macro-assembler-arm.cc
diff --git a/src/arm/macro-assembler-arm.cc b/src/arm/macro-assembler-arm.cc
index 8e187a49f331ea25eb8881eb1b337473d425549a..8f64f5df3df71d9a4571a02adb93e53e6e2def60 100644
--- a/src/arm/macro-assembler-arm.cc
+++ b/src/arm/macro-assembler-arm.cc
@@ -3928,6 +3928,34 @@ Register GetRegisterThatIsNotOneOf(Register reg1,
 }
 
 
+void MacroAssembler::HasDictionaryInPrototypeChain(
+    Register object,
+    Register elements,
+    Register scratch,
+    Label* found) {
+  Factory* factory = isolate()->factory();
+  Register temp = elements;
+  Label loop_again;
+
+  // scratch contained elements pointer.
+  mov(temp, object);
+
+  // Loop based on the map going up the prototype chain.
+  bind(&loop_again);
+  ldr(temp, FieldMemOperand(temp, HeapObject::kMapOffset));
+  ldr(scratch, FieldMemOperand(temp, Map::kBitField2Offset));
+  Ubfx(scratch, scratch, Map::kElementsKindShift, Map::kElementsKindBitCount);
+  cmp(scratch, Operand(DICTIONARY_ELEMENTS));
+  b(eq, found);
+  ldr(temp, FieldMemOperand(temp, Map::kPrototypeOffset));
+  cmp(temp, Operand(factory->null_value()));
+  b(ne, &loop_again);
+
+  // Restore elements
+  ldr(elements, FieldMemOperand(object, JSObject::kElementsOffset));
+}
+
+
 #ifdef DEBUG
 bool AreAliased(Register reg1,
                 Register reg2,