[turbofan] Use ObjectIsReceiver directly for inlining.

test/mjsunit/regress/regress-crbug-640369.js

Index: test/mjsunit/regress/regress-crbug-640369.js
diff --git a/test/mjsunit/regress/regress-3392.js b/test/mjsunit/regress/regress-crbug-640369.js
similarity index 58%
copy from test/mjsunit/regress/regress-3392.js
copy to test/mjsunit/regress/regress-crbug-640369.js
index 375f30210ce11272799c78b51463d97fc6b65998..97982d1224fc0d89cce2414122d8c7b2d211c346 100644
--- a/test/mjsunit/regress/regress-3392.js
+++ b/test/mjsunit/regress/regress-crbug-640369.js
@@ -4,15 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
+function A() {
+  this.x = 0;
+  for (var i = 0; i < max; ) {}
+}
 function foo() {
-  var a = {b: -1.5};
-  for (var i = 0; i < 1; i++) {
-    a.b = 1;
-  }
-  assertTrue(0 <= a.b);
+  for (var i = 0; i < 1; i = 2) %OptimizeOsr();
+  return new A();
 }
-
-foo();
-foo();
-%OptimizeFunctionOnNextCall(foo);
-foo();
+try { foo(); } catch (e) { }