[ic] Fixed receiver_map register trashing in KeyedStoreIC megamorphic.

test/mjsunit/regress/regress-crbug-571370.js

Index: test/mjsunit/regress/regress-crbug-571370.js
diff --git a/test/message/for-in-loop-initializers-destructuring.js b/test/mjsunit/regress/regress-crbug-571370.js
similarity index 60%
copy from test/message/for-in-loop-initializers-destructuring.js
copy to test/mjsunit/regress/regress-crbug-571370.js
index eab8b81cf371b13c0bf44a48cb106acb1a59badf..5fd9a2484b8ecc343cdbbe5af57006435d3ebcac 100644
--- a/test/message/for-in-loop-initializers-destructuring.js
+++ b/test/mjsunit/regress/regress-crbug-571370.js
@@ -1,9 +1,10 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-destructuring-bind
 
-function f() {
-  for (var [x, y] = {} in {});
+var val = [0.5];
+var arr = [0.5];
+for (var i = -1; i < 1; i++) {
+  arr[i] = val;
 }
+assertEquals(val, arr[-1]);