Fix JSObject::EnsureCanContainElements to correctly iterate over Arguments

TEST=mjsunit/elements-kind.js

Review URL: http://codereview.chromium.org/8437094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -8743,7 +8743,12 @@ MaybeObject* JSReceiver::SetPrototype(Object* value,
 MaybeObject* JSObject::EnsureCanContainElements(Arguments* args,
                                                 uint32_t first_arg,
                                                 uint32_t arg_count) {
-  return EnsureCanContainElements(args->arguments() - first_arg, arg_count);
+  // Elements in |Arguments| are ordered backwards (because they're on the
+  // stack), but the method that's called here iterates over them in forward
+  // direction.
+  return EnsureCanContainElements(
+      args->arguments() - first_arg - (arg_count - 1),
+      arg_count);
 }
 
 

test/mjsunit/elements-kind.js

@@ -317,5 +317,14 @@ if (support_smi_only_arrays) {
   assertKind(elements_kind.fast, c);
 }
 
+// Test that Array.push() correctly handles SMI elements.
+if (support_smi_only_arrays) {
+  var a = [1, 2];
+  assertKind(elements_kind.fast_smi_only, a);
+  a.push(3, 4, 5);
+  assertKind(elements_kind.fast_smi_only, a);
+  assertEquals([1, 2, 3, 4, 5], a);
+}
+
 // Throw away type information in the ICs for next stress run.
 gc();