Make ElementsAccessors more tolerant of varying backing store types

test/mjsunit/regress/regress-observe-empty-double-array.js

Index: test/mjsunit/regress/regress-observe-empty-double-array.js
diff --git a/test/mjsunit/fast-array-length.js b/test/mjsunit/regress/regress-observe-empty-double-array.js
similarity index 87%
copy from test/mjsunit/fast-array-length.js
copy to test/mjsunit/regress/regress-observe-empty-double-array.js
index 42f2c38f49b1dd3a3c0ffa867f7db368df78e760..aea9c73b2291010870a01d496f2a299f6b40dcb2 100644
--- a/test/mjsunit/fast-array-length.js
+++ b/test/mjsunit/regress/regress-observe-empty-double-array.js
@@ -25,13 +25,13 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-// This is a regression test for overlapping key and value registers.
-
-
-var a = [0, 1, 2, 3, 4, 5];
-assertTrue(%HasFastSmiElements(a));
-a.length = (1 << 30);
-assertFalse(%HasFastSmiElements(a));
+// Flags: --harmony-observation --allow-natives-syntax
+//
+// Test passes if it does not crash.
 
+arr = [1.1];
+Object.observe(arr, function(){});
+arr.length = 0;
+assertTrue(%HasFastDoubleElements(arr));
+// Should not crash
+arr.push(1.1);