Use a stub in crankshaft for grow store arrays.

src/isolate.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #include "src/v8.h"
 
 #include "src/ast.h"
 #include "src/base/platform/platform.h"
@@ skipping 1991 matching lines @@
     ToBooleanStub::InstallDescriptors(this);
     ToNumberStub::InstallDescriptors(this);
     ArrayConstructorStubBase::InstallDescriptors(this);
     InternalArrayConstructorStubBase::InstallDescriptors(this);
     FastNewClosureStub::InstallDescriptors(this);
     FastNewContextStub::InstallDescriptors(this);
     NumberToStringStub::InstallDescriptors(this);
     StringAddStub::InstallDescriptors(this);
     RegExpConstructResultStub::InstallDescriptors(this);
     KeyedLoadGenericElementStub::InstallDescriptors(this);
+    GrowArrayElementsStub::InstallDescriptors(this);
   }
 
   CallDescriptors::InitializeForIsolate(this);
 
   initialized_from_snapshot_ = (des != NULL);
 
   return true;
 }
 
 
@@ skipping 340 matching lines @@
   // The simulator uses a separate JS stack.
   Address jssp_address = Simulator::current(isolate_)->get_sp();
   uintptr_t jssp = reinterpret_cast<uintptr_t>(jssp_address);
   if (jssp < stack_guard->real_jslimit()) return true;
 #endif  // USE_SIMULATOR
   return reinterpret_cast<uintptr_t>(this) < stack_guard->real_climit();
 }
 
 
 } }  // namespace v8::internal