[turbofan] Introduce proper ObjectIsReceiver operator.

test/mjsunit/compiler/double-array-to-global.js

Index: test/mjsunit/compiler/double-array-to-global.js
diff --git a/test/mjsunit/compiler/regress-491578.js b/test/mjsunit/compiler/double-array-to-global.js
similarity index 68%
copy from test/mjsunit/compiler/regress-491578.js
copy to test/mjsunit/compiler/double-array-to-global.js
index c27570456c31e9a191fe1f4f1ea17b80f29de98e..e221d90358e8084ccbe254c5cd6597a919103c23 100644
--- a/test/mjsunit/compiler/regress-491578.js
+++ b/test/mjsunit/compiler/double-array-to-global.js
@@ -4,12 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) {
-  if (x === undefined) return;
-  while (true) {
-    while (1 || 2) { }
-    f();
+var a = [-0, 0];
+var b;
+function foo(a) {
+  for (var i = 0; i < 2; ++i) {
+    b = a[i];
   }
 }
+foo(a);
+foo(a);
 %OptimizeFunctionOnNextCall(foo);
-foo();
+foo(a);