Merged r17441 into 3.20 branch.

test/mjsunit/regress/regress-crbug-309623.js

Index: test/mjsunit/regress/regress-crbug-309623.js
diff --git a/test/mjsunit/regress/regress-crbug-233737.js b/test/mjsunit/regress/regress-crbug-309623.js
similarity index 86%
copy from test/mjsunit/regress/regress-crbug-233737.js
copy to test/mjsunit/regress/regress-crbug-309623.js
index 835726b22429ec3cca68df956255d47c53fcfd25..12473c7947f70495eae8644671107caf86a8490c 100644
--- a/test/mjsunit/regress/regress-crbug-233737.js
+++ b/test/mjsunit/regress/regress-crbug-309623.js
@@ -27,16 +27,20 @@
 
 // Flags: --allow-natives-syntax
 
-var a = new Array(2);
-a[0] = 1;
+var u = new Uint32Array(2);
+u[0] = 1;
+u[1] = 0xEE6B2800;
+
+var a = [0, 1, 2];
+a[0] = 0;  // Kill the COW.
 assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastHoleyElements(a));
 
-function hole(i) {
-  return a[i] << 0;
+function foo(i) {
+  a[0] = u[i];
+  return a[0];
 }
 
-assertEquals(1, hole(0));
-assertEquals(1, hole(0));
-%OptimizeFunctionOnNextCall(hole);
-assertEquals(0, hole(1));
+assertEquals(u[0], foo(0));
+assertEquals(u[0], foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(u[1], foo(1));