From dc14d6f4354839468d41fa943c46c2010b72803c Mon Sep 17 00:00:00 2001
From: "mstarzinger@chromium.org"
 <mstarzinger@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 29 Aug 2013 13:56:08 +0000
Subject: [PATCH] Implement materialization support for JSArray types.

R=hpayer@chromium.org
TEST=mjsunit/regress/regress-crbug-150729 (+FastLiteral)

Review URL: https://codereview.chromium.org/23502004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16429 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/deoptimizer.cc | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index a553ec1..b76da18 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -1697,13 +1697,25 @@ Handle<Object> Deoptimizer::MaterializeNextHeapObject() {
         Handle<Object> properties = MaterializeNextValue();
         Handle<Object> elements = MaterializeNextValue();
         object->set_properties(FixedArray::cast(*properties));
-        object->set_elements(FixedArray::cast(*elements));
+        object->set_elements(FixedArrayBase::cast(*elements));
         for (int i = 0; i < length - 3; ++i) {
           Handle<Object> value = MaterializeNextValue();
           object->FastPropertyAtPut(i, *value);
         }
         break;
       }
+      case JS_ARRAY_TYPE: {
+        Handle<JSArray> object =
+            isolate_->factory()->NewJSArray(0, map->elements_kind());
+        materialized_objects_->Add(object);
+        Handle<Object> properties = MaterializeNextValue();
+        Handle<Object> elements = MaterializeNextValue();
+        Handle<Object> length = MaterializeNextValue();
+        object->set_properties(FixedArray::cast(*properties));
+        object->set_elements(FixedArrayBase::cast(*elements));
+        object->set_length(*length);
+        break;
+      }
       default:
         PrintF("[couldn't handle instance type %d]\n", map->instance_type());
         UNREACHABLE();
-- 
2.7.4