Fix ASSERT violation when BinaryOpIC::Transition recurses into itself

test/mjsunit/regress/regress-crbug-352586.js

Index: test/mjsunit/regress/regress-crbug-352586.js
diff --git a/test/mjsunit/regress/regress-350865.js b/test/mjsunit/regress/regress-crbug-352586.js
similarity index 53%
copy from test/mjsunit/regress/regress-350865.js
copy to test/mjsunit/regress/regress-crbug-352586.js
index 74234db8842929a57d93a10cda0f62078f014845..2210480990b30e5e899030e6588a29a03a56a1f3 100644
--- a/test/mjsunit/regress/regress-350865.js
+++ b/test/mjsunit/regress/regress-crbug-352586.js
@@ -2,16 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --stress-compaction --stack-size=150
+var a = {};
 
-/\2/.test("1");
-
-function rec() {
-  try {
-    rec();
-  } catch(e) {
-    /\2/.test("1");
-  }
+function getter() {
+  do {
+    return a + 1;
+  } while (false);
 }
 
-rec();
+a.__proto__ = Error("");
+a.__defineGetter__('message', getter);
+a.message;