[turbofan] Ensure that all prototypes are stable for push/pop.

test/mjsunit/regress/regress-crbug-644689-2.js

Index: test/mjsunit/regress/regress-crbug-644689-2.js
diff --git a/test/mjsunit/regress/regress-crbug-630923.js b/test/mjsunit/regress/regress-crbug-644689-2.js
similarity index 71%
copy from test/mjsunit/regress/regress-crbug-630923.js
copy to test/mjsunit/regress/regress-crbug-644689-2.js
index ff0d2dd05efbedec15a515545eac2184c36c59f3..03831b15a8c979f1e1015b22fd242bc071ddcc44 100644
--- a/test/mjsunit/regress/regress-crbug-630923.js
+++ b/test/mjsunit/regress/regress-crbug-644689-2.js
@@ -4,13 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-var o = {};
-function bar(o) {
-  return 1 + (o.t ? 1 : 2);
-}
-function foo() {
-  bar(o);
-}
+for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
+
+function foo() { [1].pop(); }
+
+foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();