Track representations of fields

test/mjsunit/elements-transition-hoisting.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 49 matching lines @@
   testDoubleConversion4(new Array(5));
   testDoubleConversion4(new Array(5));
   assertTrue(2 != %GetOptimizationStatus(testDoubleConversion4));
   %ClearFunctionTypeFeedback(testDoubleConversion4);
 
   // Make sure that non-element related map checks that are not preceded by
   // transitions in a loop still get hoisted in a way that doesn't generate a
   // deopt in simple cases.
   function testExactMapHoisting(a) {
     var object = new Object();
-    a.foo = 0;
+    a.foo = {};
     a[0] = 0;
     a[1] = 1;
     var count = 3;
     do {
       a.foo = object;  // This map check should be hoistable
       a[1] = object;
       result = a.foo == object && a[1] == object;
     } while (--count > 0);
   }
 
@@ skipping 148 matching lines @@
   testStraightLineDupeElinination(new Array(5),0,.5,0,0,0);
   testStraightLineDupeElinination(new Array(5),0,0,.5,0,0);
   testStraightLineDupeElinination(new Array(5),0,0,0,.5,0);
   testStraightLineDupeElinination(new Array(5),0,0,0,0,.5);
   %OptimizeFunctionOnNextCall(testStraightLineDupeElinination);
   testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
   testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
   assertTrue(2 != %GetOptimizationStatus(testStraightLineDupeElinination));
   %ClearFunctionTypeFeedback(testStraightLineDupeElinination);
 }