Let ComputeTarget fail if it skips over NORMAL objects.

test/mjsunit/regress/regress-2595.js

Index: test/mjsunit/regress/regress-2595.js
diff --git a/test/mjsunit/regress/regress-2596.js b/test/mjsunit/regress/regress-2595.js
similarity index 66%
copy from test/mjsunit/regress/regress-2596.js
copy to test/mjsunit/regress/regress-2595.js
index 1d327fe0f8b756242da8b5f5798cbf9c6691adb1..5bb5f6d16aed581966ce28a73190fdc95ee60d01 100644
--- a/test/mjsunit/regress/regress-2596.js
+++ b/test/mjsunit/regress/regress-2595.js
@@ -27,30 +27,31 @@
 
 // Flags: --allow-natives-syntax
 
-var bytes = new Uint8Array([
-    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]);  // kHoleNaN
-var doubles = new Float64Array(bytes.buffer);
-assertTrue(isNaN(doubles[0]));
+var p = { f: function () { return "p"; } };
+var o = Object.create(p);
+o.x = true;
+delete o.x;  // slow case object
 
-var prototype = [2.5, 2.5];
-var array = [3.5, 3.5];
-array.__proto__ = prototype;
-assertTrue(%HasFastDoubleElements(array));
+var u = { x: 0, f: function () { return "u"; } };  // object with some other map
 
-function boom(index) {
-  array[index] = doubles[0];
-  return array[index];
+function F(x) {
+  return x.f();
 }
 
-assertTrue(isNaN(boom(0)));
-assertTrue(isNaN(boom(0)));
-assertTrue(isNaN(boom(0)));
-
-// Test hydrogen
-%OptimizeFunctionOnNextCall(boom);
-assertTrue(isNaN(boom(0)));
-assertTrue(isNaN(boom(0)));
-assertTrue(isNaN(boom(0)));
-
-
-
+// First make CALL IC in F go MEGAMORPHIC and ensure that we put the stub
+// that calls p.f (guarded by a negative dictionary lookup on the reciever)
+// into the stub cache
+assertEquals("p", F(o));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+
+// Optimize F. We will inline p.f into F guarded by map checked against
+// receiver which does not work for slow case objects.
+%OptimizeFunctionOnNextCall(F);
+assertEquals("p", F(o));
+
+// Add f to o. o's map will *not* change.
+o.f = function () { return "o"; };
+assertEquals("o", F(o));