[runtime] MigrateFastToFast: fix check for unboxed inobject doubles

test/mjsunit/regress/regress-crbug-718779.js

Index: test/mjsunit/regress/regress-crbug-718779.js
diff --git a/test/mjsunit/regress/regress-crbug-718779.js b/test/mjsunit/regress/regress-crbug-718779.js
new file mode 100644
index 0000000000000000000000000000000000000000..e62c10729f8a4bee33b6611f72ab9781c151376b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-718779.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_1()
+{
+    __v_1.p2 = 2147483648;
+    __v_1.p3 = 3;
+    __v_1.p4 = 4;
+    __v_1.p5 = 2147483648;
+    __v_1.p6 = 6;
+}
+function __f_2()
+{
+    delete __v_1.p6;
+    delete __v_1.p5;
+}
+var __v_1 = { };
+__f_1(__v_1);
+__f_2(__v_1);
+__f_1(__v_1);