Do not inline array resize operations for outdated prototype maps.

test/mjsunit/regress/regress-crbug-523213.js

Index: test/mjsunit/regress/regress-crbug-523213.js
diff --git a/test/mjsunit/regress/regress-449291.js b/test/mjsunit/regress/regress-crbug-523213.js
similarity index 65%
copy from test/mjsunit/regress/regress-449291.js
copy to test/mjsunit/regress/regress-crbug-523213.js
index fb56027b67f3f176f1432c11b39075aec6cc8429..15b16bb4f9e6488f08d292c6e3feb0ace994791d 100644
--- a/test/mjsunit/regress/regress-449291.js
+++ b/test/mjsunit/regress/regress-crbug-523213.js
@@ -4,16 +4,18 @@
 
 // Flags: --allow-natives-syntax
 
-a = {y:1.5};
-a.y = 1093445778;
-b = a.y;
-c = {y:{}};
+var v1 = [];
+var v2 = [];
+v1.__proto__ = v2;
 
-function f() {
-  return {y: b};
+function f(){
+  var a = [];
+  for(var i=0; i<2; i++){
+    a.push([]);
+    a = v2;
+  }
 }
 
 f();
-f();
 %OptimizeFunctionOnNextCall(f);
-assertEquals(f().y, 1093445778);
+f();