Fix polymorphic load handling.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/150453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18954 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 98191ce..0b189d5 100644 (file)
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5697,10 +5697,15 @@ void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
   int count = 0;
   HBasicBlock* join = NULL;
   HBasicBlock* number_block = NULL;
+  bool handled_string = false;
 
   bool handle_smi = false;
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
+    if (info.type()->Is(HeapType::String())) {
+      if (handled_string) continue;
+      handled_string = true;
+    }
     if (info.CanLoadMonomorphic()) {
       count++;
       if (info.type()->Is(HeapType::Number())) {
@@ -5711,8 +5716,8 @@ void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
   }
 
   count = 0;
-  bool handled_string = false;
   HControlInstruction* smi_check = NULL;
+  handled_string = false;
 
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);