Add a test case for issue 618

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 3895)
+++ src/objects.cc	(working copy)
@@ -4845,12 +4845,6 @@
        obj != Heap::null_value();
        obj = obj->GetPrototype()) {
     JSObject* js_object = JSObject::cast(obj);
-    if (!js_object->HasFastProperties()) {
-      // Only allow fast case objects, as the map check in the inline
-      // constructor which check for changes to the prototype chain cannot
-      // handle dictionary case objects.
-      return false;
-    }
     for (int i = 0; i < this_property_assignments_count(); i++) {
       LookupResult result;
       String* name = GetThisPropertyAssignmentName(i);