Fix overwriting order of object literal properties for MATERIALIZED_LITERALs

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22982005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ast.cc

@@ -273,7 +273,8 @@ void ObjectLiteral::CalculateEmitStore(Zone* zone) {
     uint32_t hash = literal->Hash();
     // If the key of a computed property is in the table, do not emit
     // a store for the property later.
-    if (property->kind() == ObjectLiteral::Property::COMPUTED &&
+    if ((property->kind() == ObjectLiteral::Property::MATERIALIZED_LITERAL ||
+         property->kind() == ObjectLiteral::Property::COMPUTED) &&
         table.Lookup(literal, hash, false, allocator) != NULL) {
       property->set_emit_store(false);
     } else {

test/mjsunit/object-literal-overwrite.js

@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Check that constants and computed properties are overwriting each other
 // correctly, i.e., the last initializer for any name is stored in the object.
 
@@ -49,7 +51,7 @@ var foo3 = {
 
 var foo4 = {
   bar: function(b){},
-  bar: 7,
+  bar: 4,
   bar: function(){return 7},
 };
 
@@ -68,6 +70,14 @@ var foo7 = {
   15: 7
 }
 
+function foo8(i) {
+  var obj = {
+    x: {a: i},
+    x: 7
+  };
+  return obj.x;
+};
+
 assertEquals(7, foo1.bar);
 assertEquals(7, foo2.bar);
 assertEquals(7, foo3.bar);
@@ -76,6 +86,12 @@ assertEquals(7, foo5[13]);
 assertEquals(7, foo6[14.31]);
 assertEquals(7, foo7[15]);
 
+assertEquals(7, foo8(1));
+assertEquals(7, foo8(1));
+%OptimizeFunctionOnNextCall(foo8);
+assertEquals(7, foo8(1));
+
+
 // Test for the classic code generator.
 
 function fun(x) {