Fix wrong bailout id in polymorphic stores.

Fix wrong bailout id in polymorphic stores.

BUG=chromium:259787
R=titzer@chromium.org, ulan@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=15763

[Toon Verwaest, 2013-07-18 18:17:02]

PTAL

[titzer, 2013-07-19 07:23:05]

lgtm

https://chromiumcodereview.appspot.com/19528005/diff/7002/test/mjsunit/regres...
File test/mjsunit/regress/poly_count_operation.js (right):

https://chromiumcodereview.appspot.com/19528005/diff/7002/test/mjsunit/regres...
test/mjsunit/regress/poly_count_operation.js:45: set:function(new_v) {
Do we need a version of this test that deopts on get? That case doesn't have
anything to do with your changes, but might be worth having in the regression
suite as well.

[ulan, 2013-07-19 08:34:09]

LGTM

[Toon Verwaest, 2013-07-19 08:44:16]

https://chromiumcodereview.appspot.com/19528005/diff/7002/test/mjsunit/regres...
File test/mjsunit/regress/poly_count_operation.js (right):

https://chromiumcodereview.appspot.com/19528005/diff/7002/test/mjsunit/regres...
test/mjsunit/regress/poly_count_operation.js:45: set:function(new_v) {
Although a bit convoluted perhaps, that's exactly what "v = undefined" + the NaN
check checks. Now I added an explicit getter test as well.

On 2013/07/19 07:23:05, titzer wrote:
> Do we need a version of this test that deopts on get? That case doesn't have
> anything to do with your changes, but might be worth having in the regression
> suite as well.

[Toon Verwaest, 2013-07-19 08:45:52]

Committed patchset #6 manually as r15763 (presubmit successful).