Allow merging of monomorphic accesses to tracked fields.

test/mjsunit/field-type-tracking.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --nostress-opt --track-field-types
 
 (function() {
   var o = { text: "Hello World!" };
   function A() {
     this.a = o;
@@ skipping 129 matching lines @@
   var f1 = new Narf(1);
   var f2 = new Narf(2);
   var f3 = new Narf(3);
   function baz(f, y) { f.y = y; }
   baz(f1, {y: 9});
   baz(f2, {y: 9});
   %OptimizeFunctionOnNextCall(baz);
   baz(f3, {a: -1});
   assertUnoptimized(baz);
 })();
+
+(function() {
+  function Foo(x) { this.x = x; this.a = x; }
+  function Bar(x) { this.x = x; this.b = x; }
+  function readA(o) { return o.x.a; }
+  var f = new Foo({a:1});
+  var b = new Bar({a:2});
+  assertEquals(readA(f), 1);
+  assertEquals(readA(b), 2);
+  assertEquals(readA(f), 1);
+  assertEquals(readA(b), 2);
+  %OptimizeFunctionOnNextCall(readA);
+  assertEquals(readA(f), 1);
+  assertEquals(readA(b), 2);
+  assertOptimized(readA);
+  f.a.y = 0;
+  assertUnoptimized(readA);
+})();