Two bugfixes for hydrogen-based array constructors

CacheInitialJSArrayMaps needs to be able to pick up where it left off,
as it can now be called from a handlfied context.

Disable incremental marking for CCTest SetJitCodeEventHandler, as it allocates
during compilation.

BUG=

Review URL: https://codereview.chromium.org/14642002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -8922,9 +8922,14 @@ static MUST_USE_RESULT MaybeObject* CacheInitialJSArrayMaps(
        i < kFastElementsKindCount; ++i) {
     Map* new_map;
     ElementsKind next_kind = GetFastElementsKindFromSequenceIndex(i);
+    if (current_map->HasElementsTransition()) {
+      new_map = current_map->elements_transition_map();
+      ASSERT(new_map->elements_kind() == next_kind);
+    } else {
       MaybeObject* maybe_new_map =
           current_map->CopyAsElementsKind(next_kind, INSERT_TRANSITION);
       if (!maybe_new_map->To(&new_map)) return maybe_new_map;
+    }
     maps->set(next_kind, new_map);
     current_map = new_map;
   }

test/cctest/test-api.cc

@@ -12187,6 +12187,7 @@ static bool MatchPointers(void* key1, void* key2) {
 
 TEST(SetJitCodeEventHandler) {
   i::FLAG_stress_compaction = true;
+  i::FLAG_incremental_marking = false;
   const char* script =
     "function bar() {"
     "  var sum = 0;"