Fix missing Smi check in grow mode keyed stores.

test/mjsunit/regress/regress-grow-store-smi-check.js

Index: test/mjsunit/regress/regress-grow-store-smi-check.js
diff --git a/test/mjsunit/array-non-smi-length.js b/test/mjsunit/regress/regress-grow-store-smi-check.js
similarity index 76%
copy from test/mjsunit/array-non-smi-length.js
copy to test/mjsunit/regress/regress-grow-store-smi-check.js
index 23a25ee797bd68690ad2a7ce26a9135e23b486e2..381141d52317c22cf19547a3626280fa2cb1ba9b 100644
--- a/test/mjsunit/array-non-smi-length.js
+++ b/test/mjsunit/regress/regress-grow-store-smi-check.js
@@ -27,20 +27,27 @@
 
 // Flags: --allow-natives-syntax
 
-function TestNonSmiArrayLength() {
-  function f(a) {
-    return a.length+1;
-  }
-
-  var a = [];
-  a.length = 0xFFFF;
-  assertSame(0x10000, f(a));
-  assertSame(0x10000, f(a));
+// The below test function was generated from part of a WebKit layout
+// test library setup routine: fast/canvas/webgl/resources/pnglib.js
 
-  %OptimizeFunctionOnNextCall(f);
-  a.length = 0xFFFFFFFF;
-  assertSame(0x100000000, f(a));
+function test(crc32) {
+  for (var i = 0; i < 256; i++) {
+    var c = i;
+    for (var j = 0; j < 8; j++) {
+      if (c & 1) {
+        c = -306674912 ^ ((c >> 1) & 0x7fffffff);
+      } else {
+        c = (c >> 1) & 0x7fffffff;
+      }
+    }
+    crc32[i] = c;
+  }
 }
 
-TestNonSmiArrayLength();
+var a = [0.5];
+for (var i = 0; i < 256; ++i) a[i] = i;
 
+test([0.5]);
+test(a);
+%OptimizeFunctionOnNextCall(test);
+test(a);