[ic] Ensure state of load/store ICs always progresses.

test/mjsunit/regress/regress-v8-5697.js

Index: test/mjsunit/regress/regress-v8-5697.js
diff --git a/test/mjsunit/regress/regress-v8-5697.js b/test/mjsunit/regress/regress-v8-5697.js
new file mode 100644
index 0000000000000000000000000000000000000000..5a88614b1355466e36839a3b7a72ee94b18d3897
--- /dev/null
+++ b/test/mjsunit/regress/regress-v8-5697.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function load(o) { return o.x; }
+
+for (var x = 0; x < 1000; ++x) {
+  load({x});
+  load({x});
+  try { load(); } catch (e) { }
+}
+
+assertOptimized(load);
+
+
+function store(o) { o.x = -1; }
+
+for (var x = 0; x < 1000; ++x) {
+  store({x});
+  store({x});
+  try { store(); } catch (e) { }
+}
+
+assertOptimized(store);