Fix regressions triggered by map invalidation during graph creation.

test/mjsunit/regress/regress-map-invalidation-1.js

Index: test/mjsunit/regress/regress-map-invalidation-1.js
diff --git a/test/mjsunit/regress/regress-2671.js b/test/mjsunit/regress/regress-map-invalidation-1.js
similarity index 87%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-map-invalidation-1.js
index 8da1b8f07f69c487fe9913e485c60f3e257e0986..bcc6bbb615a1286248271bcf58e998fb9724154c 100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -27,19 +27,22 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
+var c = { x: 2, y: 1 };
+
+function h() {
+  %MigrateInstance(c);
+  return 2;
+}
+%NeverOptimizeFunction(h);
+
 function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i] = 1/y;
-  assertFalse(isNaN(a[i]));
+  for (var i = 0; i < 100000; i++) {
+    var n = c.x + h();
+    assertEquals(4, n);
+  }
+  var o2 = [{ x: 2.5, y:1 }];
+  return o2;
 }
 
 f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();