Fix mix-up in HasEnumerableElements()

Only JSArrays ever have packed elements; holey elements can be on any kind of object.

BUG=chromium:568525
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1515963002

Cr-Commit-Position: refs/heads/master@{#32755}

src/objects.cc

@@ -7985,9 +7985,8 @@ bool HasEnumerableElements(JSObject* object) {
     case FAST_SMI_ELEMENTS:
     case FAST_ELEMENTS:
     case FAST_DOUBLE_ELEMENTS: {
-      int length = object->IsJSArray()
-                       ? Smi::cast(JSArray::cast(object)->length())->value()
-                       : object->elements()->length();
+      DCHECK(object->IsJSArray());
+      int length = Smi::cast(JSArray::cast(object)->length())->value();
       return length > 0;
     }
     case FAST_HOLEY_SMI_ELEMENTS:
@@ -8003,8 +8002,9 @@ bool HasEnumerableElements(JSObject* object) {
     }
     case FAST_HOLEY_DOUBLE_ELEMENTS: {
       FixedDoubleArray* elements = FixedDoubleArray::cast(object->elements());
-      DCHECK(object->IsJSArray());
-      int length = Smi::cast(JSArray::cast(object)->length())->value();
+      int length = object->IsJSArray()
+                       ? Smi::cast(JSArray::cast(object)->length())->value()
+                       : elements->length();
       for (int i = 0; i < length; i++) {
         if (!elements->is_the_hole(i)) return true;
       }

test/mjsunit/regress/regress-crbug-568525.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = /a/;
+a[4] = 1.5;
+for (var x in a) {}