[runtime] %TransitionElementsKind works for any kind of JSObject.

The optimizing compilers actually invoke %TransitionElementsKind for
any kind of JSObject, the only relevant thing is the elements kind.
The runtime function was however checking for JSArray unnecessarily.
This only worked by coincindence in Crankshaft because the stub would
normally not call into the runtime fallback.

R=jarin@chromium.org
BUG=chromium:629823

Review-Url: https://codereview.chromium.org/2166963004
Cr-Commit-Position: refs/heads/master@{#37919}

src/runtime/runtime-array.cc

@@ -87,7 +87,7 @@ RUNTIME_FUNCTION(Runtime_FixedArraySet) {
 RUNTIME_FUNCTION(Runtime_TransitionElementsKind) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Map, to_map, 1);
   ElementsKind to_kind = to_map->elements_kind();
   ElementsAccessor::ForKind(to_kind)->TransitionElementsKind(object, to_map);

test/mjsunit/regress/regress-crbug-629823.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+function bar() {
+  o[0] = +o[0];
+  o = /\u23a1|__v_4/;
+}
+bar();
+bar();
+bar();
+function foo() { bar(); }
+%OptimizeFunctionOnNextCall(foo);
+foo();