[deoptimizer] Remove incorrect cast for materialized property array.

Bug: chromium:774824
Change-Id: Id3d0af0bb55c0985393fe3b139308b6b706e7bc0
Reviewed-on: https://chromium-review.googlesource.com/725339Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48665}

src/deoptimizer.cc

@@ -3581,7 +3581,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);
       Handle<Object> index = materializer.FieldAt(value_index);
-      object->set_raw_properties_or_hash(FixedArray::cast(*properties));
+      object->set_raw_properties_or_hash(*properties);
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_table(*table);
       object->set_index(*index);
@@ -3596,7 +3596,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);
       Handle<Object> index = materializer.FieldAt(value_index);
-      object->set_raw_properties_or_hash(FixedArray::cast(*properties));
+      object->set_raw_properties_or_hash(*properties);
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_table(*table);
       object->set_index(*index);

test/mjsunit/regress/regress-774824.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var a = new Set().values();
+  a.outOfObjectProperty = undefined;
+  %DeoptimizeNow();
+  return !a;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();