[turbofan] Handle ObjectIsReceiver in escape analysis.

test/mjsunit/regress/regress-crbug-631027.js

Index: test/mjsunit/regress/regress-crbug-631027.js
diff --git a/test/mjsunit/regress/regress-crbug-602595.js b/test/mjsunit/regress/regress-crbug-631027.js
similarity index 68%
copy from test/mjsunit/regress/regress-crbug-602595.js
copy to test/mjsunit/regress/regress-crbug-631027.js
index 7f6d478e05d096d4bf03cca13271f6d49ec354b9..f3d04b8efd4e28715149527ff15d5fd03e2f8741 100644
--- a/test/mjsunit/regress/regress-crbug-602595.js
+++ b/test/mjsunit/regress/regress-crbug-631027.js
@@ -4,9 +4,9 @@
 
 // Flags: --allow-natives-syntax --turbo-escape
 
-function f(a) { return [a] }
-
-assertEquals([23], f(23));
-assertEquals([42], f(42));
+function f() {
+  with ({ value:"foo" }) { return value; }
+}
+assertEquals("foo", f());
 %OptimizeFunctionOnNextCall(f);
-assertEquals([65], f(65));
+assertEquals("foo", f());