Rollback of r11638, r11636 on trunk branch.

test/mjsunit/regress/regress-crbug-122271.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 21 matching lines @@
 
 var a = [0, 0, 0, 1];
 var b = [0, 0, 0, "one"];
 var c = [0, 0, 0, 1];
 c.foo = "baz";
 
 function foo(array) {
   array.foo = "bar";
 }
 
-assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastObjectElements(b));
+assertTrue(%HasFastSmiOnlyElements(a));
+assertTrue(%HasFastElements(b));
 
 foo(a);
 foo(b);
 
-assertTrue(%HasFastSmiElements(a));
-assertTrue(%HasFastObjectElements(b));
+assertTrue(%HasFastSmiOnlyElements(a));
+assertTrue(%HasFastElements(b));