Harden IsMoreGeneralElementsKindTransition.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/213783004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/elements-kind.cc

@@ -178,6 +178,11 @@ static bool IsTypedArrayElementsKind(ElementsKind elements_kind) {
 }
 
 
+static inline bool IsFastTransitionTarget(ElementsKind elements_kind) {
+  return IsFastElementsKind(elements_kind) ||
+      elements_kind == DICTIONARY_ELEMENTS;
+}
+
 bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
                                          ElementsKind to_kind) {
   if (IsTypedArrayElementsKind(from_kind) ||
@@ -193,6 +198,7 @@ bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
         return false;
     }
   }
+  if (IsFastElementsKind(from_kind) && IsFastTransitionTarget(to_kind)) {
     switch (from_kind) {
       case FAST_SMI_ELEMENTS:
         return to_kind != FAST_SMI_ELEMENTS;
@@ -213,6 +219,8 @@ bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
       default:
         return false;
     }
+  }
+  return false;
 }