Fix compose-discard crasher from 11524. We can't do a call (to a generic

stub) unless there is a pointer map.  This does not fix the 3d-raytrace
regression, that will be in another change.
Review URL: https://chromiumcodereview.appspot.com/10382102

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11539 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ia32/lithium-codegen-ia32.cc

@@ -2275,8 +2275,7 @@ void LCodeGen::DoLoadNamedFieldPolymorphic(LLoadNamedFieldPolymorphic* instr) {
 
   int map_count = instr->hydrogen()->types()->length();
   Handle<String> name = instr->hydrogen()->name();
-  if (map_count == 0) {
-    ASSERT(instr->hydrogen()->need_generic());
+  if (map_count == 0 && instr->hydrogen()->need_generic()) {
     __ mov(ecx, name);
     Handle<Code> ic = isolate()->builtins()->LoadIC_Initialize();
     CallCode(ic, RelocInfo::CODE_TARGET, instr);
@@ -2291,20 +2290,28 @@ void LCodeGen::DoLoadNamedFieldPolymorphic(LLoadNamedFieldPolymorphic* instr) {
       __ jmp(&done, Label::kNear);
       __ bind(&next);
     }
+    if (instr->hydrogen()->need_generic()) {
+      if (map_count != 0) {
         Handle<Map> map = instr->hydrogen()->types()->last();
         __ cmp(FieldOperand(object, HeapObject::kMapOffset), map);
-    if (instr->hydrogen()->need_generic()) {
         Label generic;
         __ j(not_equal, &generic, Label::kNear);
         EmitLoadFieldOrConstantFunction(result, object, map, name);
         __ jmp(&done, Label::kNear);
         __ bind(&generic);
+      }
       __ mov(ecx, name);
       Handle<Code> ic = isolate()->builtins()->LoadIC_Initialize();
       CallCode(ic, RelocInfo::CODE_TARGET, instr);
     } else {
+      if (map_count != 0) {
+        Handle<Map> map = instr->hydrogen()->types()->last();
+        __ cmp(FieldOperand(object, HeapObject::kMapOffset), map);
         DeoptimizeIf(not_equal, instr->environment());
         EmitLoadFieldOrConstantFunction(result, object, map, name);
+      } else {
+        DeoptimizeIf(no_condition, instr->environment());
+      }
     }
     __ bind(&done);
   }