Fix slack tracking when instance prototype changes.

test/mjsunit/regress/regress-crbug-157019.js

Index: test/mjsunit/regress/regress-crbug-157019.js
diff --git a/test/mjsunit/regress/regress-inlining-function-literal-context.js b/test/mjsunit/regress/regress-crbug-157019.js
similarity index 80%
copy from test/mjsunit/regress/regress-inlining-function-literal-context.js
copy to test/mjsunit/regress/regress-crbug-157019.js
index 9b7f7ac76882f09e1cc837373c1bee547c645de3..1c54089ff9866f222536535e2f8940558fed0cc3 100644
--- a/test/mjsunit/regress/regress-inlining-function-literal-context.js
+++ b/test/mjsunit/regress/regress-crbug-157019.js
@@ -25,29 +25,30 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc
+// Flags: --allow-natives-syntax --nocrankshaft
 
-function mkbaz(x) {
-  function baz() {
-    return function () {
-      return [x];
-    }
-  }
-  return baz;
+function makeConstructor() {
+  return function() {
+    this.a = 1;
+    this.b = 2;
+  };
 }
 
-var baz = mkbaz(1);
+var c1 = makeConstructor();
+var o1 = new c1();
+
+c1.prototype = {};
 
-function foo() {
-  var f = baz();
-  return f();
+for (var i = 0; i < 10; i++) {
+  var o = new c1();
+  for (var j = 0; j < 8; j++) {
+    o["x" + j] = 0;
+  }
 }
 
-// Tenure.
-gc();
-gc();
+var c2 = makeConstructor();
+var o2 = new c2();
 
-assertArrayEquals([1], foo());
-assertArrayEquals([1], foo());
-%OptimizeFunctionOnNextCall(foo);
-assertArrayEquals([1], foo());
+for (var i = 0; i < 50000; i++) {
+  new c2();
+}