Correct handling of arrays with callbacks in the prototype chain.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index ec78d27e8ab50c0df2b00abfe74d89b5325e88d0..789da0b680d55002aaa2adab596f4f8546b4ebc3 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2012,6 +2012,8 @@ class JSReceiver: public HeapObject {
                    bool search_hidden_prototypes = false);
   void Lookup(Name* name, LookupResult* result);
 
+  bool MayHaveIndexedCallbacksInPrototypeChain();
+
  protected:
   Smi* GenerateIdentityHash();
 
@@ -5291,6 +5293,9 @@ class Code: public HeapObject {
   DECLARE_VERIFIER(Code)
 
   void ClearInlineCaches();
+  void ClearInlineCaches(Kind* kind);
+  void ClearInlineCaches(Kind kind);
+
   void ClearTypeFeedbackCells(Heap* heap);
 
   BailoutId TranslatePcOffsetToAstId(uint32_t pc_offset);
@@ -5615,6 +5620,15 @@ class Map: public HeapObject {
   class IsUnstable:                 public BitField<bool, 29,  1> {};
   class IsMigrationTarget:          public BitField<bool, 30,  1> {};
 
+  // Bit field 4.
+  inline uint32_t bit_field4();
+  inline void set_bit_field4(uint32_t bits);
+
+  class HasElementCallbacks:        public BitField<int,   0,  1> {};
+
+  inline void set_has_element_callbacks(bool value);
+  inline bool has_element_callbacks();
+
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
   // property is set to a value that is not a JSObject, the prototype
@@ -6169,7 +6183,8 @@ class Map: public HeapObject {
   static const int kCodeCacheOffset = kDescriptorsOffset + kPointerSize;
   static const int kDependentCodeOffset = kCodeCacheOffset + kPointerSize;
   static const int kBitField3Offset = kDependentCodeOffset + kPointerSize;
-  static const int kSize = kBitField3Offset + kPointerSize;
+  static const int kBitField4Offset = kBitField3Offset + kPointerSize;
+  static const int kSize = kBitField4Offset + kPointerSize;
 
   // Layout of pointer fields. Heap iteration code relies on them
   // being continuously allocated.