Fix materialization of captured objects with field tracking.

test/mjsunit/compiler/escape-analysis.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 283 matching lines @@
     deopt.deopt;
     assertEquals(99, o1.x);
     assertEquals(99, o2.b.x);
   }
   deep(); deep();
   %OptimizeFunctionOnNextCall(deep);
   deep(); deep();
   delete deopt.deopt;
   deep(); deep();
 })();
+
+
+// Test materialization of a field that requires a Smi value.
+(function testSmiField() {
+  var deopt = { deopt:false };
+  function constructor() {
+    this.x = 1;
+  }
+  function field(x) {
+    var o = new constructor();
+    o.x = x;
+    deopt.deopt
+    assertEquals(x, o.x);
+  }
+  field(1); field(2);
+  %OptimizeFunctionOnNextCall(field);
+  field(3); field(4);
+  delete deopt.deopt;
+  field(5.5); field(6.5);
+})();
+
+
+// Test materialization of a field that requires a heap object value.
+(function testHeapObjectField() {
+  var deopt = { deopt:false };
+  function constructor() {
+    this.x = {};
+  }
+  function field(x) {
+    var o = new constructor();
+    o.x = x;
+    deopt.deopt
+    assertEquals(x, o.x);
+  }
+  field({}); field({});
+  %OptimizeFunctionOnNextCall(field);
+  field({}); field({});
+  delete deopt.deopt;
+  field(1); field(2);
+})();