Reland of [builtins] DeleteProperty: Handle last-added fast properties

test/mjsunit/regress/regress-252797.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 27 matching lines @@
 
 // We assume dict usage for null prototype.
 var holder = Object.create(null, {
   holderMethod: {value: function() {}}
 });
 assertFalse(%HasFastProperties(holder));
 
 // Create a receiver into dictionary mode.
 var receiver = Object.create(holder, {
   killMe: {value: 0, configurable: true},
+  keepMe: {value: 0, configurable: true}
 });
 delete receiver.killMe;
 assertFalse(%HasFastProperties(receiver));
 
 // The actual function to test, triggering the retrieval of the wrong map.
 function callConstantFunctionOnPrototype(obj) {
   obj.holderMethod();
 }
 
 callConstantFunctionOnPrototype(receiver);
 callConstantFunctionOnPrototype(receiver);
 %OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
 callConstantFunctionOnPrototype(receiver);
 
 // Make sure that the function is still optimized.
 assertOptimized(callConstantFunctionOnPrototype);