Elements load depends on the type of the receiver.

test/mjsunit/regress/regress-load-elements.js

Index: test/mjsunit/regress/regress-load-elements.js
diff --git a/test/mjsunit/pixel-array-rounding.js b/test/mjsunit/regress/regress-load-elements.js
old mode 100755
new mode 100644
similarity index 80%
copy from test/mjsunit/pixel-array-rounding.js
copy to test/mjsunit/regress/regress-load-elements.js
index 0c307e62e55297faefe3e2ae253e7a344f4ee6c6..02670f395b0266eff47a8ff65b48703febb9e210
--- a/test/mjsunit/pixel-array-rounding.js
+++ b/test/mjsunit/regress/regress-load-elements.js
@@ -27,18 +27,23 @@
 
 // Flags: --allow-natives-syntax
 
-var pixels = new Uint8ClampedArray(8);
-
-function f() {
-  for (var i = 0; i < 8; i++) {
-    pixels[i] = (i * 1.1);
+function bad_func(o,a) {
+  for (var i = 0; i < 1; ++i) {
+    o.prop = 0;
+    var x = a[0];
   }
-  return pixels[1] + pixels[6];
 }
 
-f();
-f();
-assertEquals(6, pixels[5]);
-%OptimizeFunctionOnNextCall(f);
-f();
-assertEquals(6, pixels[5]);
+o = new Object();
+a = {};
+a[0] = 1;
+bad_func(o, a);
+
+o = new Object();
+bad_func(o, a);
+
+// Optimize, before the fix, the element load and subsequent tagged-to-i were

[Jakob Kummerow, 2012/08/30 16:42:03]

Outdated comment. At least, s/tagged-to-i/fixed-array-length/

[Toon Verwaest, 2012/08/30 17:27:08]

Done.

+// hoisted above the map check, which can't be hoisted due to the map-changing
+// store.
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, "");