Fixed type feedback in presence of negative lookups.

test/mjsunit/regress/regress-252797.js

Index: test/mjsunit/regress/regress-252797.js
diff --git a/test/mjsunit/regress/regress-crbug-233737.js b/test/mjsunit/regress/regress-252797.js
similarity index 64%
copy from test/mjsunit/regress/regress-crbug-233737.js
copy to test/mjsunit/regress/regress-252797.js
index 835726b22429ec3cca68df956255d47c53fcfd25..406be85b59fb210f91e429c7e97473507cc77168 100644
--- a/test/mjsunit/regress/regress-crbug-233737.js
+++ b/test/mjsunit/regress/regress-252797.js
@@ -27,16 +27,31 @@
 
 // Flags: --allow-natives-syntax
 
-var a = new Array(2);
-a[0] = 1;
-assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastHoleyElements(a));
+// The type feedback oracle had a bug when retrieving the map from an IC
+// starting with a negative lookup.
 
-function hole(i) {
-  return a[i] << 0;
+// Create a holder in fast mode.
+var holder = Object.create(null, {
+  holderMethod: {value: function() {}}
+});
+assertTrue(%HasFastProperties(holder));
+
+// Create a receiver into dictionary mode.
+var receiver = Object.create(holder, {
+  killMe: {value: 0, configurable: true},
+});
+delete receiver.killMe;
+assertFalse(%HasFastProperties(receiver));
+
+// The actual function to test, triggering the retrieval of the wrong map.
+function callConstantFunctionOnPrototype(obj) {
+  obj.holderMethod();
 }
 
-assertEquals(1, hole(0));
-assertEquals(1, hole(0));
-%OptimizeFunctionOnNextCall(hole);
-assertEquals(0, hole(1));
+callConstantFunctionOnPrototype(receiver);
+callConstantFunctionOnPrototype(receiver);
+%OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
+callConstantFunctionOnPrototype(receiver);
+
+// Make sure that the function is still optimized.
+assertTrue(2 != %GetOptimizationStatus(callConstantFunctionOnPrototype));