Correctly handle instances without elements in polymorphic keyed load/store.

test/mjsunit/regress/regress-331416.js

Index: test/mjsunit/regress/regress-331416.js
diff --git a/test/mjsunit/regress/regress-polymorphic-store.js b/test/mjsunit/regress/regress-331416.js
similarity index 77%
copy from test/mjsunit/regress/regress-polymorphic-store.js
copy to test/mjsunit/regress/regress-331416.js
index 4723a7f4343bb79daf5283325ee5c1082abefa79..0c60fced14e1c185919985fd011c9ca46d93ff3f 100644
--- a/test/mjsunit/regress/regress-polymorphic-store.js
+++ b/test/mjsunit/regress/regress-331416.js
@@ -1,4 +1,4 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
+// Copyright 2014 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -27,22 +27,26 @@
 
 // Flags: --allow-natives-syntax
 
-var o1 = {};
-o1.f1 = function() { return 10; };
-o1.x = 5;
-o1.y = 2;
-var o2 = {};
-o2.x = 5;
-o2.y = 5;
-
-function store(o, v) {
-  o.y = v;
+function load(a, i) {
+  return a[i];
 }
+load([1, 2, 3], "length");
+load(3);
+load([1, 2, 3], 3);
+load(0, 0);
+%OptimizeFunctionOnNextCall(load);
+assertEquals(2, load([1, 2, 3], 1));
+assertEquals(undefined, load(0, 0));
 
-store(o2, 0);
-store(o1, 0);
-store(o2, 0);
+function store(a, i, x) {
+  a[i] = x;
+}
+store([1, 2, 3], "length", 3);
+store(3);
+store([1, 2, 3], 3, 3);
+store(0, 0, 1);
 %OptimizeFunctionOnNextCall(store);
-store(o1, 10);
-assertEquals(5, o1.x);
-assertEquals(10, o1.y);
+var a = [1, 2, 3];
+store(a, 1, 1);
+assertEquals(1, a[1]);
+store(0, 0, 1);