Fix deopts caused by misplaced COW checks.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 69a060df56ac1d5743ed71a82fe8b6d08aadd59f..78ea443e76519a2d0e9a2bf8ce0f0829c15c19c1 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -3911,7 +3911,7 @@ HInstruction* HGraphBuilder::BuildMonomorphicElementAccess(HValue* object,
   HInstruction* mapcheck = AddInstruction(new(zone()) HCheckMap(object, map));
   HInstruction* elements = AddInstruction(new(zone()) HLoadElements(object));
   bool fast_double_elements = map->has_fast_double_elements();
-  if (is_store && !fast_double_elements) {
+  if (is_store && map->has_fast_elements()) {
     AddInstruction(new(zone()) HCheckMap(
         elements, isolate()->factory()->fixed_array_map()));
   }
@@ -4024,7 +4024,8 @@ HValue* HGraphBuilder::HandlePolymorphicElementAccess(HValue* object,
             elements_kind == JSObject::FAST_DOUBLE_ELEMENTS;
         if (is_store && !fast_double_elements) {

[danno, 2011/07/21 11:44:02]

Should also be map->has_fast_elements()

[Jakob Kummerow, 2011/07/21 12:01:32]

Except that we don't have an object called |map| at this point. I've changed it
to "elements_kind == JSObject::FAST_ELEMENTS" instead.

           AddInstruction(new(zone()) HCheckMap(
-              elements, isolate()->factory()->fixed_array_map()));
+              elements, isolate()->factory()->fixed_array_map(),
+              elements_kind_branch));
         }
         HBasicBlock* if_jsarray = graph()->CreateBasicBlock();
         HBasicBlock* if_fastobject = graph()->CreateBasicBlock();