Fix JSArray-specific length lookup in polymorphic array handling

test/mjsunit/regress/regress-crbug-263276.js

Index: test/mjsunit/regress/regress-crbug-263276.js
diff --git a/test/mjsunit/array-non-smi-length.js b/test/mjsunit/regress/regress-crbug-263276.js
similarity index 83%
copy from test/mjsunit/array-non-smi-length.js
copy to test/mjsunit/regress/regress-crbug-263276.js
index 23a25ee797bd68690ad2a7ce26a9135e23b486e2..05aa94cc857136d070093e026ef3daa6d98189c0 100644
--- a/test/mjsunit/array-non-smi-length.js
+++ b/test/mjsunit/regress/regress-crbug-263276.js
@@ -27,20 +27,20 @@
 
 // Flags: --allow-natives-syntax
 
-function TestNonSmiArrayLength() {
-  function f(a) {
-    return a.length+1;
-  }
+var array1 = [];
+array1.foo = true;
 
-  var a = [];
-  a.length = 0xFFFF;
-  assertSame(0x10000, f(a));
-  assertSame(0x10000, f(a));
+var array2 = [];
+array2.bar = true;
 
-  %OptimizeFunctionOnNextCall(f);
-  a.length = 0xFFFFFFFF;
-  assertSame(0x100000000, f(a));
+function bad(array) {
+  array[array.length] = 1;
 }
 
-TestNonSmiArrayLength();
-
+bad(array1);
+bad(array1);
+bad(array2);  // Length is now 1.
+bad(array2);  // Length is now 2.
+%OptimizeFunctionOnNextCall(bad);
+bad(array2);  // Length is now 3.
+assertEquals(3, array2.length);