Don't EnsureHasInitialMap on non-constructors

test/mjsunit/regress/regress-ensure-initial-map.js

Index: test/mjsunit/regress/regress-ensure-initial-map.js
diff --git a/test/mjsunit/array-push12.js b/test/mjsunit/regress/regress-ensure-initial-map.js
similarity index 56%
copy from test/mjsunit/array-push12.js
copy to test/mjsunit/regress/regress-ensure-initial-map.js
index f4c15b484b41197c9007113ecf8f91fe909cc5d3..dbd4762fcda69a61f597b8ff2180556edf283ad4 100644
--- a/test/mjsunit/array-push12.js
+++ b/test/mjsunit/regress/regress-ensure-initial-map.js
@@ -4,20 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-var a = [];
-for (var i = -20; i < 0; ++i) {
-  a[i] = 0;
+var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
+function f(o, b) {
+  if (b) {
+    return o instanceof x;
+  }
 }
 
-function g() {
-    [].push.apply(a, arguments);
-}
+%OptimizeFunctionOnNextCall(f);
+f();
 
-function f() {
-  g();
+function g() {
+  return new x();
 }
 
-g();
-g();
-%OptimizeFunctionOnNextCall(f);
-f();
+%OptimizeFunctionOnNextCall(g);
+assertThrows(()=>g());