Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed.

test/mjsunit/array-methods-read-only-length.js

Index: test/mjsunit/array-methods-read-only-length.js
diff --git a/test/mjsunit/array-methods-read-only-length.js b/test/mjsunit/array-methods-read-only-length.js
index 925ef1f67fe2047fe78297d7e27031a7c8a2487a..2943b162c9ef26e5584f7b815bc7fd8304ee205d 100644
--- a/test/mjsunit/array-methods-read-only-length.js
+++ b/test/mjsunit/array-methods-read-only-length.js
@@ -51,8 +51,7 @@ testAdd("fast properties");
 
 testAdd("normalized");
 
-function testRemove(mode) {
-  var a = [1, 2, 3];
+function testRemove(a, mode) {
   Object.defineProperty(a, "length", { writable : false});
 
   function check(f) {
@@ -91,11 +90,22 @@ function testRemove(mode) {
   check(splice);
   %OptimizeFunctionOnNextCall(splice);
   check(splice);
-}
 
-testRemove("fast properties");
+  %ClearFunctionTypeFeedback(pop);
+  %ClearFunctionTypeFeedback(shift);
+  %ClearFunctionTypeFeedback(splice);
+}
 
-testRemove("normalized");
+for (var i = 0; i < 3; i++) {
+  var a = [1, 2, 3];
+  if (i == 1) {
+    a = [1, 2, 3.5];
+  } else if (i == 2) {
+    a = [1, 2, "string"];
+  }
+  testRemove(a, "fast properties");
+  testRemove(a, "normalized");
+}
 
 var b = [];
 Object.defineProperty(b.__proto__, "0", {