Correct handling of arrays with callbacks in the prototype chain.

src/heap.cc

Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index fd5504ffe27a5fa347a8024e17ea72c3d3793273..4c3ceb18a56fb2910884c2d206519ecfdb01bca8 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -467,6 +467,16 @@ intptr_t Heap::SizeOfObjects() {
 }
 
 
+void Heap::ClearAllKeyedStoreICs() {
+  HeapObjectIterator it(code_space());
+
+  for (Object* object = it.Next(); object != NULL; object = it.Next()) {
+    Code* code = Code::cast(object);
+    code->ClearInlineCaches(Code::KEYED_STORE_IC);
+  }
+}
+
+
 void Heap::RepairFreeListsAfterBoot() {
   PagedSpaces spaces(this);
   for (PagedSpace* space = spaces.next();
@@ -2453,6 +2463,7 @@ MaybeObject* Heap::AllocatePartialMap(InstanceType instance_type,
   int bit_field3 = Map::EnumLengthBits::encode(Map::kInvalidEnumCache) |
                    Map::OwnsDescriptors::encode(true);
   reinterpret_cast<Map*>(result)->set_bit_field3(bit_field3);
+  reinterpret_cast<Map*>(result)->set_bit_field4(0);
   return result;
 }
 
@@ -2486,6 +2497,7 @@ MaybeObject* Heap::AllocateMap(InstanceType instance_type,
                    Map::OwnsDescriptors::encode(true);
   map->set_bit_field3(bit_field3);
   map->set_elements_kind(elements_kind);
+  map->set_bit_field4(0);
 
   return map;
 }