Collect side effects on paths to dominated block including the dominator.

test/mjsunit/allocation-folding.js

Index: test/mjsunit/allocation-folding.js
diff --git a/test/mjsunit/regress/regress-crbug-242870.js b/test/mjsunit/allocation-folding.js
similarity index 85%
copy from test/mjsunit/regress/regress-crbug-242870.js
copy to test/mjsunit/allocation-folding.js
index 7183375ca811cedc81c870d34e694e98cf727f9b..a730bf12a032b538f2f5a7870bbc3e9c594435ac 100644
--- a/test/mjsunit/regress/regress-crbug-242870.js
+++ b/test/mjsunit/allocation-folding.js
@@ -25,19 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-var non_const_true = true;
-
+// Flags: --allow-natives-syntax --nouse-osr
 function f() {
-  return (non_const_true || true && g());
+  var elem1 = [1,2,3];
+  for (var i=0; i < 100000; i++) {
+    var bar = [1];
+  }
+  var elem2 = [1,2,3];
+  return elem2;
 }
 
-function g() {
-  for (;;) {}
+f(); f(); f();
+%OptimizeFunctionOnNextCall(f);
+var result = f();
+
+for (var i=0; i < 100000; i++) {
+  var bar = [1];
 }
 
-assertTrue(f());
-assertTrue(f());
-%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+assertEquals(result[2], 3);