The Elements pointer in a JSObject can have a filler map instead of a

The Elements pointer in a JSObject can have a filler map instead of a
valid fixed array, iff a gc occurred while allocating a fixed array as
part of array construction. Heap verification needs protection against
examining the elements object in this case.

R=svenpanne@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=17397

[mvstanton, 2013-10-25 12:01:49]

PTAL, thx!
--Michael

[Sven Panne, 2013-10-25 12:13:40]

lgtm

[mvstanton, 2013-10-25 12:26:55]

Committed patchset #1 manually as r17397 (presubmit successful).

[Jakob Kummerow, 2013-10-28 21:31:00]

This CL causes compile failures when heap verification support is enabled in
Release mode, see e.g.:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/6498

[mvstanton, 2013-10-29 08:27:28]

Oops, fixed here: https://codereview.chromium.org/48963006/