A64: Synchronize with r15922.

test/mjsunit/regress/regress-crbug-263276.js

Index: test/mjsunit/regress/regress-crbug-263276.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-crbug-263276.js
similarity index 83%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-crbug-263276.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..05aa94cc857136d070093e026ef3daa6d98189c0 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-crbug-263276.js
@@ -27,24 +27,20 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
+var array1 = [];
+array1.foo = true;
 
-function f(a, b) {
-  return g("c", "d");
-}
-
-function g(a, b) {
-  g.constructor.apply(this, arguments);
-}
+var array2 = [];
+array2.bar = true;
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+function bad(array) {
+  array[array.length] = 1;
 }
 
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+bad(array1);
+bad(array1);
+bad(array2);  // Length is now 1.
+bad(array2);  // Length is now 2.
+%OptimizeFunctionOnNextCall(bad);
+bad(array2);  // Length is now 3.
+assertEquals(3, array2.length);