Fix ASSERT violation when BinaryOpIC::Transition recurses into itself

test/mjsunit/regress/regress-crbug-352586.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stress-compaction --stack-size=150
+var a = {};
 
-/\2/.test("1");
-
-function rec() {
-  try {
-    rec();
-  } catch(e) {
-    /\2/.test("1");
-  }
+function getter() {
+  do {
+    return a + 1;
+  } while (false);
 }
 
-rec();
+a.__proto__ = Error("");
+a.__defineGetter__('message', getter);
+a.message;