Non-JSArrays must always have holey elements.

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index 45a79c1b3cc4477be0bdc3cfdc4825ba35cd1e1a..0adc8730f5f31b01dc406963988bed5ad7005390 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1302,8 +1302,9 @@ Handle<JSFunction> Factory::NewFunction(Handle<String> name,
   Handle<JSFunction> function = NewFunction(
       name, code, prototype, read_only_prototype);
 
-  Handle<Map> initial_map = NewMap(
-      type, instance_size, GetInitialFastElementsKind());
+  ElementsKind elements_kind =
+      type == JS_ARRAY_TYPE ? FAST_SMI_ELEMENTS : FAST_HOLEY_SMI_ELEMENTS;
+  Handle<Map> initial_map = NewMap(type, instance_size, elements_kind);
   if (prototype->IsTheHole() && !function->shared()->is_generator()) {
     prototype = NewFunctionPrototype(function);
   }