[runtime] Ensure Object.freeze() deoptimizes code that depends on global property cells.

test/mjsunit/regress/regress-crbug-663750.js

Index: test/mjsunit/regress/regress-crbug-663750.js
diff --git a/test/mjsunit/compiler/regress-644048.js b/test/mjsunit/regress/regress-crbug-663750.js
similarity index 62%
copy from test/mjsunit/compiler/regress-644048.js
copy to test/mjsunit/regress/regress-crbug-663750.js
index ee2dd6edef4792a5777f77ba9fcc1eff12d87a07..3ebba92d2ae4f801095a04ba7b802c9c9b451ba0 100644
--- a/test/mjsunit/compiler/regress-644048.js
+++ b/test/mjsunit/regress/regress-crbug-663750.js
@@ -4,13 +4,21 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) {
-  (x
-      ? (!0 / 0)
-         : x) | 0
+var v = 0;
+function foo(a) {
+  v = a;
 }
 
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
 foo(3);
+assertEquals(3, v);
+
+Object.freeze(this);
+
+foo(4);
+foo(5);
+%OptimizeFunctionOnNextCall(foo);
+foo(6);
+assertEquals(3, v);