Fix embedded new-space pointer in LCmpObjectEqAndBranch.

test/mjsunit/regress/regress-crbug-240032.js

Index: test/mjsunit/regress/regress-crbug-240032.js
diff --git a/test/mjsunit/elide-double-hole-check-9.js b/test/mjsunit/regress/regress-crbug-240032.js
similarity index 78%
copy from test/mjsunit/elide-double-hole-check-9.js
copy to test/mjsunit/regress/regress-crbug-240032.js
index 4d277af695ce3c774af2f2a1715049810aa617dd..7ce95d34bd07ec8362d59db2c766d7452e65b833 100644
--- a/test/mjsunit/elide-double-hole-check-9.js
+++ b/test/mjsunit/regress/regress-crbug-240032.js
@@ -27,23 +27,22 @@
 
 // Flags: --allow-natives-syntax
 
-var do_set = false;
-
-function set_proto_elements() {
-  try {} catch (e) {}  // Don't optimize or inline
-  if (do_set) Array.prototype[1] = 1.5;
-}
-
-function f(a, i) {
-  set_proto_elements();
-  return a[i] + 0.5;
+// Generate closures in that live in new-space.
+function mk() {
+  return function() {};
 }
+assertInstanceof(mk(), Function);
+assertInstanceof(mk(), Function);
 
-var arr = [0.0,,2.5];
-assertEquals(0.5, f(arr, 0));
-assertEquals(0.5, f(arr, 0));
-%OptimizeFunctionOnNextCall(f);
-assertEquals(0.5, f(arr, 0));
-do_set = true;
-assertEquals(2, f(arr, 1));
+// Setup constant function using above closures.
+var o = {};
+o.func = mk();
 
+// Optimize object comparison with new-space RHS.
+function cmp(o, f) {
+  return f === o.func;
+}
+assertTrue(cmp(o, o.func));
+assertTrue(cmp(o, o.func));
+%OptimizeFunctionOnNextCall(cmp);
+assertTrue(cmp(o, o.func));