Merged r11533 into 3.8 branch.

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 90a8d3e1b843caa04ec42c00cc04457c13364c5c..fd6e00076ce029164dbce4bf885b570a19b8d170 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -443,12 +443,19 @@ static inline MaybeObject* EnsureJSArrayWithWritableFastElements(
   HeapObject* elms = array->elements();
   Map* map = elms->map();
   if (map == heap->fixed_array_map()) {
-    if (args == NULL || !array->HasFastSmiOnlyElements()) {
+    if (array->HasFastElements()) return elms;
+    if (args == NULL) {
+      if (array->HasFastDoubleElements()) {

[Michael Starzinger, 2012/07/20 13:39:40]

As discussed offline: This fix might not even be necessary for 3.8 because the
empty_fixed_array is not used as a sentinel for empty double arrays. In this
case merging the regression test to proof that is sufficient.

+        ASSERT(elms == heap->empty_fixed_array());
+        MaybeObject* maybe_transition =
+            array->TransitionElementsKind(FAST_ELEMENTS);
+        if (maybe_transition->IsFailure()) return maybe_transition;
+      }
       return elms;
     }
   } else if (map == heap->fixed_cow_array_map()) {
     MaybeObject* maybe_writable_result = array->EnsureWritableFastElements();
-    if (args == NULL || !array->HasFastSmiOnlyElements() ||
+    if (args == NULL || array->HasFastElements() ||
         maybe_writable_result->IsFailure()) {
       return maybe_writable_result;
     }