[ic] Properly deal with all oddballs when updating BinaryOpIC state.

test/mjsunit/regress/regress-crbug-659967.js

Index: test/mjsunit/regress/regress-crbug-659967.js
diff --git a/test/message/regress/regress-4829-1.js b/test/mjsunit/regress/regress-crbug-659967.js
similarity index 78%
copy from test/message/regress/regress-4829-1.js
copy to test/mjsunit/regress/regress-crbug-659967.js
index 1ad5feda8cb96cd24e4c47f7407c9699d150c327..654f00de60c49bf5e2b3571fc4af208a6f74c016 100644
--- a/test/message/regress/regress-4829-1.js
+++ b/test/mjsunit/regress/regress-crbug-659967.js
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function tag() {}
+function f() { null >> arguments; }
 
-tag(tag`\xyy`);
+f();
+f();