Make all load-named-fields depend on their map-check, unless explicitly ignored.

test/mjsunit/regress/regress-hoist-load-named-field.js

Index: test/mjsunit/regress/regress-hoist-load-named-field.js
diff --git a/test/mjsunit/regress/regress-int32-truncation.js b/test/mjsunit/regress/regress-hoist-load-named-field.js
similarity index 76%
copy from test/mjsunit/regress/regress-int32-truncation.js
copy to test/mjsunit/regress/regress-hoist-load-named-field.js
index dec4ac1195a6c4928d84eac8cc8dc9496bf66600..7df07a04ce32ac858bcfd680be072953df0fa4b8 100644
--- a/test/mjsunit/regress/regress-int32-truncation.js
+++ b/test/mjsunit/regress/regress-hoist-load-named-field.js
@@ -27,35 +27,40 @@
 
 // Flags: --allow-natives-syntax
 
-function f(i, b) {
-  var a = 0;
-  if (b) {
-    var c = 1 << i;
-    a = c + c;
+// Load fields should not be hoisted beyond their check maps when the check maps
+// cannot be hoisted due to changes in elements kinds.
+function f(o, a) {
+  var v;
+  var i = 1;
+  while (i < 2) {
+    v = o.y;
+    a[0] = 1.5;
+    i++;
   }
-  var x = a >> 3;
-  return a;
+  return v;
 }
 
-f(1, false);
-f(1, true);
+f({y:1.4}, [1]);
+f({y:1.6}, [1]);
 %OptimizeFunctionOnNextCall(f);
-assertEquals((1 << 30) * 2, f(30, true));
+f({x:1}, [1]);
 
-
-var global = 1;
-
-function f2(b) {
-  var a = 0;
-  if (b) {
-    a = global;
+// Polymorphic loads should not be hoisted beyond their compare maps.
+function f2(o) {
+  var i = 0;
+  var v;
+  while (i < 1) {
+    v = o.x;
+    i++;
   }
-  var x = a >> 3;
-  return a;
+  return v;
 }
 
-f2(false);
-f2(true);
+var o1 = { x: 1.5 };
+var o2 = { y: 1, x: 1 };
+
+f2(o1);
+f2(o1);
+f2(o2);
 %OptimizeFunctionOnNextCall(f2);
-global = 2.5;
-assertEquals(global, f2(true));
+f2(o2);