Merge bleeding_edge 17696:18016.

test/mjsunit/regress/regress-crbug-318671.js

Index: test/mjsunit/regress/regress-crbug-318671.js
diff --git a/test/mjsunit/regress/regress-2671-1.js b/test/mjsunit/regress/regress-crbug-318671.js
similarity index 90%
copy from test/mjsunit/regress/regress-2671-1.js
copy to test/mjsunit/regress/regress-crbug-318671.js
index 042a501e5adb86cd7d868ec721edef8edde27274..54a7d5eeb6c597195dadbdf996fbd029a5b504e0 100644
--- a/test/mjsunit/regress/regress-2671-1.js
+++ b/test/mjsunit/regress/regress-crbug-318671.js
@@ -27,19 +27,12 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
-function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i]++;
-  assertTrue(isNaN(a[i]));
-}
+function add(x, y) { return x + y; }
 
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+print(add({ a: 1 }, "a"));
+print(add({ b: 1 }, "b"));
+print(add({ c: 1 }, "c"));
 
+%OptimizeFunctionOnNextCall(add);
+
+print(add("a", 1));