Merged r15196, r15203, r15204, r15207, r15214 into trunk branch.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 66b040743746e500ef935bc00f12153124578945..93d77d1327ba84cf9a4af645c5ed26c5477123dc 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6084,6 +6084,11 @@ void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
                                  isolate()->factory()->empty_string(),
                                  Runtime::FunctionForId(function_id),
                                  3));
+
+    // De-opt if elements kind changed from boilerplate_elements_kind.
+    Handle<Map> map = Handle<Map>(original_boilerplate_object->map(),
+                                  isolate());
+    AddInstruction(HCheckMaps::New(literal, map, zone()));
   }
 
   // The array is expected in the bailout environment during computation
@@ -6423,7 +6428,8 @@ bool HOptimizedGraphBuilder::TryStorePolymorphicAsMonomorphic(
   AddInstruction(HCheckMaps::New(object, types, zone()));
   HInstruction* store;
   CHECK_ALIVE_OR_RETURN(
-      store = BuildStoreNamedField(object, name, value, types->at(0), &lookup),
+      store = BuildStoreNamedField(
+          object, name, value, types->at(count - 1), &lookup),
       true);
   Push(value);
   store->set_position(expr->position());