Merged r15196, r15203, r15204, r15207, r15214 into trunk branch.

test/mjsunit/regress/regress-polymorphic-store.js

Index: test/mjsunit/regress/regress-polymorphic-store.js
diff --git a/test/mjsunit/regress/regress-2671.js b/test/mjsunit/regress/regress-polymorphic-store.js
similarity index 85%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-polymorphic-store.js
index 8da1b8f07f69c487fe9913e485c60f3e257e0986..4723a7f4343bb79daf5283325ee5c1082abefa79 100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-polymorphic-store.js
@@ -27,19 +27,22 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
-function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i] = 1/y;
-  assertFalse(isNaN(a[i]));
-}
+var o1 = {};
+o1.f1 = function() { return 10; };
+o1.x = 5;
+o1.y = 2;
+var o2 = {};
+o2.x = 5;
+o2.y = 5;
 
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+function store(o, v) {
+  o.y = v;
+}
 
+store(o2, 0);
+store(o1, 0);
+store(o2, 0);
+%OptimizeFunctionOnNextCall(store);
+store(o1, 10);
+assertEquals(5, o1.x);
+assertEquals(10, o1.y);