Fix polymorphic load handling.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5679 matching lines @@
 void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
     BailoutId ast_id,
     BailoutId return_id,
     HValue* object,
     SmallMapList* types,
     Handle<String> name) {
   // Something did not match; must use a polymorphic load.
   int count = 0;
   HBasicBlock* join = NULL;
   HBasicBlock* number_block = NULL;
+  bool handled_string = false;
 
   bool handle_smi = false;
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
+    if (info.type()->Is(HeapType::String())) {
+      if (handled_string) continue;
+      handled_string = true;
+    }
     if (info.CanLoadMonomorphic()) {
       count++;
       if (info.type()->Is(HeapType::Number())) {
         handle_smi = true;
         break;
       }
     }
   }
 
   count = 0;
-  bool handled_string = false;
   HControlInstruction* smi_check = NULL;
+  handled_string = false;
 
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
     if (info.type()->Is(HeapType::String())) {
       if (handled_string) continue;
       handled_string = true;
     }
     if (!info.CanLoadMonomorphic()) continue;
 
     if (count == 0) {
@@ skipping 5729 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal