Clear next map word when folding allocations into js arrays.

test/mjsunit/allocation-folding.js

Index: test/mjsunit/allocation-folding.js
diff --git a/test/mjsunit/allocation-folding.js b/test/mjsunit/allocation-folding.js
index fe5fa6d855e5894c2a3f136db2c14a3a865fbe40..ec07392f2c223687f3e6c4bcd6d0df8cabde59f4 100644
--- a/test/mjsunit/allocation-folding.js
+++ b/test/mjsunit/allocation-folding.js
@@ -56,7 +56,7 @@ function doubles() {
 
 doubles(); doubles(); doubles();
 %OptimizeFunctionOnNextCall(doubles);
-var result = doubles();
+result = doubles();
 
 gc();
 
@@ -72,8 +72,31 @@ function doubles_int() {
 
 doubles_int(); doubles_int(); doubles_int();
 %OptimizeFunctionOnNextCall(doubles_int);
-var result = doubles_int();
+result = doubles_int();
 
 gc();
 
 assertEquals(result[1], 3.1);
+
+// Test allocation folding over a branch.
+
+function branch_int(left) {
+  var elem1 = [1, 2];
+  var elem2;
+  if (left) {
+    elem2 = [3, 4];
+  } else {
+    elem2 = [5, 6];
+  }
+  return elem2;
+}
+
+branch_int(1); branch_int(1); branch_int(1);
+%OptimizeFunctionOnNextCall(branch_int);
+result = branch_int(1);
+var result2 = branch_int(0);
+
+gc();
+
+assertEquals(result[1], 4);
+assertEquals(result2[1], 6);