Fix bug in constant folding object comparisons.

test/mjsunit/regress/regress-346587.js

Index: test/mjsunit/regress/regress-346587.js
diff --git a/test/mjsunit/regress/regress-347906.js b/test/mjsunit/regress/regress-346587.js
similarity index 65%
copy from test/mjsunit/regress/regress-347906.js
copy to test/mjsunit/regress/regress-346587.js
index c751618928c93015679087ee1b500637657aa341..40e3ac116cdfd9984a7ac07bf09f357bc9e03506 100644
--- a/test/mjsunit/regress/regress-347906.js
+++ b/test/mjsunit/regress/regress-346587.js
@@ -2,10 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony
+// Flags: --fold-constants --allow-natives-syntax
+
+function bar(obj) {
+  assertTrue(obj.x === 'baz');
+}
 
 function foo() {
-  return Math.clz32(12.34);
+  bar({ x : 'baz' });
 }
 
 foo();