Properly handle misses for StoreArrayLengthStub on ia32 and x64

test/mjsunit/regress/regress-2566.js

Index: test/mjsunit/regress/regress-2566.js
diff --git a/test/mjsunit/regress/regress-crbug-173974.js b/test/mjsunit/regress/regress-2566.js
similarity index 91%
copy from test/mjsunit/regress/regress-crbug-173974.js
copy to test/mjsunit/regress/regress-2566.js
index 905bd6058a0ad0fe2ebe10e4c7dafbe9945cbe3b..582bad979606008d8b6b9ffa080824fd18e58479 100644
--- a/test/mjsunit/regress/regress-crbug-173974.js
+++ b/test/mjsunit/regress/regress-2566.js
@@ -25,12 +25,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-function f() {
-  var count = "";
-  count[0] --;
+function setProp(obj, prop, val) {
+  obj[prop] = val;
 }
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var obj = [];
+setProp(obj, 'length', 1);
+setProp(obj, 0, 5);
+assertEquals(1, obj.length);