Merge r9516 into 3.4 branch.

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 9515)
+++ src/objects.cc	(working copy)
@@ -10472,8 +10472,6 @@
 // If the object is in dictionary mode, it is converted to fast elements
 // mode.
 MaybeObject* JSObject::PrepareElementsForSort(uint32_t limit) {
-  ASSERT(!HasExternalArrayElements());
-
   Heap* heap = GetHeap();
 
   if (HasDictionaryElements()) {
@@ -10503,6 +10501,9 @@
 
     set_map(new_map);
     set_elements(fast_elements);
+  } else if (HasExternalArrayElements()) {
+    // External arrays cannot have holes or undefined elements.
+    return Smi::FromInt(ExternalArray::cast(elements())->length());
   } else {
     Object* obj;
     { MaybeObject* maybe_obj = EnsureWritableFastElements();