Fix regressions triggered by map invalidation during graph creation.

test/mjsunit/regress/regress-map-invalidation-1.js

Index: test/mjsunit/regress/regress-map-invalidation-1.js
diff --git a/test/mjsunit/regress/regress-2045.js b/test/mjsunit/regress/regress-map-invalidation-1.js
similarity index 86%
copy from test/mjsunit/regress/regress-2045.js
copy to test/mjsunit/regress/regress-map-invalidation-1.js
index 822ee1fa4641b4a0ba15eee2c2a2e59411db7d4d..426fcddbf64606c67197e346601838525663b0a5 100644
--- a/test/mjsunit/regress/regress-2045.js
+++ b/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -27,23 +27,22 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() {
-  assertEquals(2, arguments.length);
-}
+var c = { x: 2, y: 1 };
 
-function bar() {
-  G.x;
-  return foo.apply(this, arguments);
+function h() {
+  %MigrateInstance(c);
+  return 2;
 }
+%NeverOptimizeFunction(h);
 
-function baz() {
-  return bar(1, 2);
+function f() {
+  for (var i = 0; i < 100000; i++) {

[titzer, 2013/08/12 13:28:58]

Are you trying to force an OSR here?

[Yang, 2013/08/12 13:49:22]

yup. we could of course also use %OptimizeFunctionOnNextCall(f, "osr") if you
prefer it that way.

+    var n = c.x + h();
+    assertEquals(4, n);
+  }
+  var o2 = [{ x: 2.5, y:1 }];
+  return o2;
 }
 
-G = {x: 0};
-baz();
-baz();
-%OptimizeFunctionOnNextCall(baz);
-baz();
-delete G.x;
-baz();
+f();
+