Fix materialization of captured objects with field tracking.

test/mjsunit/compiler/escape-analysis.js

Index: test/mjsunit/compiler/escape-analysis.js
diff --git a/test/mjsunit/compiler/escape-analysis.js b/test/mjsunit/compiler/escape-analysis.js
index 21ebcbbf49a078fcf1a6b8ed9b977ee08e56a7b7..dccc476925788ab0057d698f670cf0bbf33299f0 100644
--- a/test/mjsunit/compiler/escape-analysis.js
+++ b/test/mjsunit/compiler/escape-analysis.js
@@ -301,3 +301,43 @@
   delete deopt.deopt;
   deep(); deep();
 })();
+
+
+// Test materialization of a field that requires a Smi value.
+(function testSmiField() {
+  var deopt = { deopt:false };
+  function constructor() {
+    this.x = 1;
+  }
+  function field(x) {
+    var o = new constructor();
+    o.x = x;
+    deopt.deopt
+    assertEquals(x, o.x);
+  }
+  field(1); field(2);
+  %OptimizeFunctionOnNextCall(field);
+  field(3); field(4);
+  delete deopt.deopt;
+  field(5.5); field(6.5);
+})();
+
+
+// Test materialization of a field that requires a heap object value.
+(function testHeapObjectField() {
+  var deopt = { deopt:false };
+  function constructor() {
+    this.x = {};
+  }
+  function field(x) {
+    var o = new constructor();
+    o.x = x;
+    deopt.deopt
+    assertEquals(x, o.x);
+  }
+  field({}); field({});
+  %OptimizeFunctionOnNextCall(field);
+  field({}); field({});
+  delete deopt.deopt;
+  field(1); field(2);
+})();