The ARM assembler tests don't install the standard JS natives. When

setting up push and pop we shouldn't make too many assumptions about
the structure of classes like 'Array'.
Review URL: http://codereview.chromium.org/113068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/bootstrapper.cc

@@ -1483,14 +1483,19 @@ void Genesis::BuildSpecialFunctionTable() {
           JSFunction::cast(global->GetProperty(Heap::Array_symbol())));
   Handle<JSObject> visible_prototype =
       Handle<JSObject>(JSObject::cast(function->prototype()));
-  // Remember to skip the hidden prototype:
-  Handle<JSObject> hidden_prototype =
-      Handle<JSObject>(JSObject::cast(visible_prototype->GetPrototype()));
-  AddSpecialFunction(hidden_prototype, "pop",
+  // Remember to put push and pop on the hidden prototype if it's there.
+  Handle<JSObject> push_and_pop_prototype;
+  Handle<Object> superproto(visible_prototype->GetPrototype());
+  if (superproto->IsJSObject() &&
+      JSObject::cast(*superproto)->map()->is_hidden_prototype()) {
+    push_and_pop_prototype = Handle<JSObject>::cast(superproto);
+  } else {
+    push_and_pop_prototype = visible_prototype;
+  }
+  AddSpecialFunction(push_and_pop_prototype, "pop",
                      Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
-  AddSpecialFunction(hidden_prototype, "push",
+  AddSpecialFunction(push_and_pop_prototype, "push",
                      Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
-  ASSERT(hidden_prototype->map()->is_hidden_prototype());
 }