[turbofan] Restrict types in load elimination.

test/mjsunit/regress/regress-599412.js

Index: test/mjsunit/regress/regress-599412.js
diff --git a/test/mjsunit/regress/regress-crbug-577112.js b/test/mjsunit/regress/regress-599412.js
similarity index 68%
copy from test/mjsunit/regress/regress-crbug-577112.js
copy to test/mjsunit/regress/regress-599412.js
index 504f921a335801a51fd1c0c1a39a8b08e8872722..d5c411d0f11a1b81139c4eaefdecfb169c3b007b 100644
--- a/test/mjsunit/regress/regress-crbug-577112.js
+++ b/test/mjsunit/regress/regress-599412.js
@@ -4,12 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-Array.prototype.__proto__ = null;
-var prototype = Array.prototype;
+function h(a) {
+  if (!a) return false;
+  print();
+}
+
+function g(a) { return a.length; }
+g('0');
+g('1');
+
 function f() {
-  prototype.lastIndexOf({});
+  h(g([]));
 }
-f();
+
 f();
 %OptimizeFunctionOnNextCall(f);
 f();