Kraken recover after r20312.

src/factory.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_FACTORY_H_
 #define V8_FACTORY_H_
 
 #include "src/isolate.h"
 
 namespace v8 {
@@ skipping 374 matching lines @@
   // JS arrays are pretenured when allocated by the parser.
 
   // Create a JSArray with no elements.
   Handle<JSArray> NewJSArray(
       ElementsKind elements_kind,
       PretenureFlag pretenure = NOT_TENURED);
 
   // Create a JSArray with a specified length and elements initialized
   // according to the specified mode.
   Handle<JSArray> NewJSArray(
-      ElementsKind elements_kind,
-      int length,
-      int capacity,
-      ArrayStorageAllocationMode mode = INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE,
+      ElementsKind elements_kind, int length, int capacity,
+      ArrayStorageAllocationMode mode = DONT_INITIALIZE_ARRAY_ELEMENTS,

[Igor Sheludko, 2014/07/25 12:42:49]

Before handlification clients used to call Heap::AllocateJSArrayAndStorage()
which had
  ArrayStorageAllocationMode mode = DONT_INITIALIZE_ARRAY_ELEMENTS
parameter, but during handlification it was changed to wrong value.

       PretenureFlag pretenure = NOT_TENURED);
 
   Handle<JSArray> NewJSArray(
       int capacity,
       ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND,
       PretenureFlag pretenure = NOT_TENURED) {
     if (capacity != 0) {
       elements_kind = GetHoleyElementsKind(elements_kind);
     }
     return NewJSArray(elements_kind, 0, capacity,
@@ skipping 294 matching lines @@
                                  PretenureFlag pretenure = TENURED);
 
   Handle<JSFunction> NewFunction(Handle<Map> map,
                                  Handle<String> name,
                                  MaybeHandle<Code> maybe_code);
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_FACTORY_H_