[deoptimizer] Fix materialization of sloppy arguments.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index c698459fd0396c4f4a50ec008f0430b053bb7fd5..857c1208012f6697292dc0d85167e3d35db5412f 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -3685,11 +3685,15 @@ Handle<Object> TranslatedState::MaterializeAt(int frame_index,
           return object;
         }
         case JS_OBJECT_TYPE: {
-          Handle<JSObject> object =
-              isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED);
+          Handle<JSObject> object = isolate_->factory()->NewJSObjectFromMap(
+              map->has_sloppy_arguments_elements()
+                  ? isolate()->sloppy_arguments_map()
+                  : map,
+              NOT_TENURED);
           slot->value_ = object;
           Handle<Object> properties = MaterializeAt(frame_index, value_index);
           Handle<Object> elements = MaterializeAt(frame_index, value_index);
+          object->set_map(*map);  // Correct elements kind for sloppy arguments.
           object->set_properties(FixedArray::cast(*properties));
           object->set_elements(FixedArrayBase::cast(*elements));
           for (int i = 0; i < length - 3; ++i) {