Rollback of r11638, r11636 on trunk branch.

test/mjsunit/regress/regress-117409.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 18 matching lines @@
 
 function KeyedStoreIC(a) { a[0] = Math.E; }
 
 // Create literal with a fast double elements backing store
 var literal = [1.2];
 
 // Specialize the IC for fast double elements
 KeyedStoreIC(literal);
 KeyedStoreIC(literal);
 
-// Truncate array to 0 elements, at which point backing store will be replaced
+// Trruncate array to 0 elements, at which point backing store will be replaced
 // with empty fixed array.
 literal.length = 0;
 
 // ArrayPush built-in will replace empty fixed array backing store with 19
 // elements fixed array backing store.  This leads to a mismatch between the map
 // and the backing store.  Debug mode will crash here in set_elements accessor.
 literal.push(Math.E, Math.E);
 
 // Corrupt the backing store!
 KeyedStoreIC(literal);
 
 // Release mode will crash here when trying to visit parts of E as pointers.
 gc();