Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed.

test/mjsunit/array-methods-read-only-length.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 function testAdd(mode) {
   var a = [];
   Object.defineProperty(a, "length", { writable : false});
 
@@ skipping 33 matching lines @@
   check(splice);
   check(splice);
   %OptimizeFunctionOnNextCall(splice);
   check(splice);
 }
 
 testAdd("fast properties");
 
 testAdd("normalized");
 
-function testRemove(mode) {
-  var a = [1, 2, 3];
+function testRemove(a, mode) {
   Object.defineProperty(a, "length", { writable : false});
 
   function check(f) {
     assertThrows(function() { f(a) }, TypeError);
     assertEquals(3, a.length);
   }
 
   if (mode == "fast properties") %ToFastProperties(a);
 
   function pop(a) {
@@ skipping 18 matching lines @@
 
   function splice(a) {
     a.splice(0, 1);
   }
 
   check(splice);
   check(splice);
   check(splice);
   %OptimizeFunctionOnNextCall(splice);
   check(splice);
+
+  %ClearFunctionTypeFeedback(pop);
+  %ClearFunctionTypeFeedback(shift);
+  %ClearFunctionTypeFeedback(splice);
 }
 
-testRemove("fast properties");
-
-testRemove("normalized");
+for (var i = 0; i < 3; i++) {
+  var a = [1, 2, 3];
+  if (i == 1) {
+    a = [1, 2, 3.5];
+  } else if (i == 2) {
+    a = [1, 2, "string"];
+  }
+  testRemove(a, "fast properties");
+  testRemove(a, "normalized");
+}
 
 var b = [];
 Object.defineProperty(b.__proto__, "0", {
   set : function(v) {
     b.x = v;
     Object.defineProperty(b, "length", { writable : false });
   },
   get: function() {
     return b.x;
   }
@@ skipping 38 matching lines @@
   }
 });
 
 try {
   b.unshift(3, 4, 5);
 } catch(e) { }
 
 assertFalse(2 in b);
 assertFalse(3 in b);
 assertEquals(2, b.length);