[turbofan] Properly handle dictionary maps in the prototype chain.

test/mjsunit/regress/regress-crbug-616709.js

Index: test/mjsunit/regress/regress-crbug-616709.js
diff --git a/test/mjsunit/regress/regress-585041.js b/test/mjsunit/regress/regress-crbug-616709.js
similarity index 52%
copy from test/mjsunit/regress/regress-585041.js
copy to test/mjsunit/regress/regress-crbug-616709.js
index c072ed2a15befd66232f1b649b979f6b5d2a6014..75abe3c2e1ef233776c63fb97860a677fac2e781 100644
--- a/test/mjsunit/regress/regress-585041.js
+++ b/test/mjsunit/regress/regress-crbug-616709.js
@@ -4,18 +4,18 @@
 
 // Flags: --allow-natives-syntax
 
-function f(arr, i) {
-  arr[i] = 50;
+// Make the Object prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+  Object.prototype['X'+i] = true;
 }
 
-function boom(dummy) {
-  var arr = new Array(10);
-  f(arr, 10);
-  if (dummy) {
-    f(arr, -2147483648);
-  }
+function boom(a1) {
+  return a1[0];
 }
 
-boom(false);
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
 %OptimizeFunctionOnNextCall(boom);
-boom(false);
+boom(a);