[turbofan] Properly handle dictionary maps in the prototype chain.

test/mjsunit/regress/regress-crbug-616709.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-function f(arr, i) {
-  arr[i] = 50;
+// Make the Object prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+  Object.prototype['X'+i] = true;
 }
 
-function boom(dummy) {
-  var arr = new Array(10);
-  f(arr, 10);
-  if (dummy) {
-    f(arr, -2147483648);
-  }
+function boom(a1) {
+  return a1[0];
 }
 
-boom(false);
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
 %OptimizeFunctionOnNextCall(boom);
-boom(false);
+boom(a);