Bugfix: HCheckInstanceType::GetCheckMaskAndTag used an incorrect mask.

test/mjsunit/regress/internalized-string-not-equal.js

Index: test/mjsunit/regress/internalized-string-not-equal.js
diff --git a/test/mjsunit/elide-double-hole-check-4.js b/test/mjsunit/regress/internalized-string-not-equal.js
similarity index 86%
copy from test/mjsunit/elide-double-hole-check-4.js
copy to test/mjsunit/regress/internalized-string-not-equal.js
index e2a55055710d6aa222ca4c4aecfbe3926d9c5cca..911279b43e6b1174449132bea96fe48144657461 100644
--- a/test/mjsunit/elide-double-hole-check-4.js
+++ b/test/mjsunit/regress/internalized-string-not-equal.js
@@ -27,13 +27,14 @@
 
 // Flags: --allow-natives-syntax
 
-function f1(a, i) {
-  return a[i] + 0.5;
+// A bug in r15773, when masks for internalized string and string types
+// were reorganized.
+function equal(o1, o2) {
+  return (o1 == o2);
 }
-var arr = [0.0,,2.5];
-assertEquals(0.5, f1(arr, 0));
-assertEquals(0.5, f1(arr, 0));
-%OptimizeFunctionOnNextCall(f1);
-assertEquals(0.5, f1(arr, 0));
-Array.prototype[1] = 1.5;
-assertEquals(2, f1(arr, 1));
+var a = "abc";
+var b = "abc";
+equal(a, b);
+equal(a, b);
+%OptimizeFunctionOnNextCall(equal);
+assertTrue(equal(1.3, 1.3));