Add undefined check for default Array map in ArrayCodeGenericCommon

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 180 matching lines @@
   isolate->counters()->array_function_runtime()->Increment();
 
   JSArray* array;
   if (CalledAsConstructor(isolate)) {
     array = JSArray::cast((*args)[0]);
     // Initialize elements and length in case later allocations fail so that the
     // array object is initialized in a valid state.
     array->set_length(Smi::FromInt(0));
     array->set_elements(heap->empty_fixed_array());
     if (!FLAG_smi_only_arrays) {
-      if (array->GetElementsKind() == FAST_SMI_ONLY_ELEMENTS) {
-        Context* global_context = isolate->context()->global_context();
+      Context* global_context = isolate->context()->global_context();
+      if (array->GetElementsKind() == FAST_SMI_ONLY_ELEMENTS &&
+          !global_context->object_js_array_map()->IsUndefined()) {
         array->set_map(Map::cast(global_context->object_js_array_map()));
       }
     }
   } else {
     // Allocate the JS Array
     MaybeObject* maybe_obj =
         heap->AllocateEmptyJSArray(FAST_SMI_ONLY_ELEMENTS);
     if (!maybe_obj->To(&array)) return maybe_obj;
   }
 
@@ skipping 1530 matching lines @@
   return Handle<Code>(code_address);                        \
 }
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 } }  // namespace v8::internal