Revert 22595: "Keep new arrays allocated with 'new Array(N)' in fast mode"

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/elements.h"
 #include "src/objects.h"
@@ skipping 879 matching lines @@
  public:
   explicit FastElementsAccessor(const char* name)
       : ElementsAccessorBase<FastElementsAccessorSubclass,
                              KindTraits>(name) {}
  protected:
   friend class ElementsAccessorBase<FastElementsAccessorSubclass, KindTraits>;
   friend class SloppyArgumentsElementsAccessor;
 
   typedef typename KindTraits::BackingStore BackingStore;
 
-  // Adjusts the length of the fast backing store..
+  // Adjusts the length of the fast backing store or returns the new length or
+  // undefined in case conversion to a slow backing store should be performed.
   static Handle<Object> SetLengthWithoutNormalize(
       Handle<FixedArrayBase> backing_store,
       Handle<JSArray> array,
       Handle<Object> length_object,
       uint32_t length) {
     Isolate* isolate = array->GetIsolate();
     uint32_t old_capacity = backing_store->length();
     Handle<Object> old_length(array->length(), isolate);
     bool same_or_smaller_size = old_length->IsSmi() &&
         static_cast<uint32_t>(Handle<Smi>::cast(old_length)->value()) >= length;
@@ skipping 31 matching lines @@
         for (int i = length; i < old_length; i++) {
           Handle<BackingStore>::cast(backing_store)->set_the_hole(i);
         }
       }
       return length_object;
     }
 
     // Check whether the backing store should be expanded.
     uint32_t min = JSObject::NewElementsCapacity(old_capacity);
     uint32_t new_capacity = length > min ? length : min;
-    FastElementsAccessorSubclass::SetFastElementsCapacityAndLength(
-        array, new_capacity, length);
-    JSObject::ValidateElements(array);
-    return length_object;
+    if (!array->ShouldConvertToSlowElements(new_capacity)) {
+      FastElementsAccessorSubclass::SetFastElementsCapacityAndLength(
+          array, new_capacity, length);
+      JSObject::ValidateElements(array);
+      return length_object;
+    }
+
+    // Request conversion to slow elements.
+    return isolate->factory()->undefined_value();
   }
 
   static Handle<Object> DeleteCommon(Handle<JSObject> obj,
                                      uint32_t key,
                                      JSReceiver::DeleteMode mode) {
     ASSERT(obj->HasFastSmiOrObjectElements() ||
            obj->HasFastDoubleElements() ||
            obj->HasFastArgumentsElements());
     Isolate* isolate = obj->GetIsolate();
     Heap* heap = obj->GetHeap();
@@ skipping 1018 matching lines @@
       UNREACHABLE();
       break;
   }
 
   array->set_elements(*elms);
   array->set_length(Smi::FromInt(number_of_elements));
   return array;
 }
 
 } }  // namespace v8::internal