[deoptimizer] Fix materialization of sloppy arguments.

src/deoptimizer.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/deoptimizer.h"
 
 #include "src/accessors.h"
 #include "src/ast/prettyprinter.h"
 #include "src/codegen.h"
 #include "src/disasm.h"
@@ skipping 3667 matching lines @@
           // On 32-bit architectures, there is an extra slot there because
           // the escape analysis calculates the number of slots as
           // object-size/pointer-size. To account for this, we read out
           // any extra slots.
           for (int i = 0; i < length - 2; i++) {
             MaterializeAt(frame_index, value_index);
           }
           return object;
         }
         case JS_OBJECT_TYPE: {
-          Handle<JSObject> object =
-              isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED);
+          Handle<JSObject> object = isolate_->factory()->NewJSObjectFromMap(
+              map->has_sloppy_arguments_elements()
+                  ? isolate()->sloppy_arguments_map()
+                  : map,
+              NOT_TENURED);
           slot->value_ = object;
           Handle<Object> properties = MaterializeAt(frame_index, value_index);
           Handle<Object> elements = MaterializeAt(frame_index, value_index);
+          object->set_map(*map);  // Correct elements kind for sloppy arguments.
           object->set_properties(FixedArray::cast(*properties));
           object->set_elements(FixedArrayBase::cast(*elements));
           for (int i = 0; i < length - 3; ++i) {
             Handle<Object> value = MaterializeAt(frame_index, value_index);
             FieldIndex index = FieldIndex::ForPropertyIndex(object->map(), i);
             object->FastPropertyAtPut(index, *value);
           }
           return object;
         }
         case JS_ARRAY_TYPE: {
@@ skipping 259 matching lines @@
       CHECK(value_info->IsMaterializedObject());
 
       value_info->value_ =
           Handle<Object>(previously_materialized_objects->get(i), isolate_);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8