One of the fast cases in JSObject::MigrateFastToFast() should not be taken...

test/mjsunit/regress/regress-crbug-390918.js

Index: test/mjsunit/regress/regress-crbug-390918.js
diff --git a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js b/test/mjsunit/regress/regress-crbug-390918.js
similarity index 65%
copy from test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
copy to test/mjsunit/regress/regress-crbug-390918.js
index 658d776ea3b80cd00d256a5514603bdb3df1f179..4c202b3a9b22a1e4802788136f69c39174ae0d51 100644
--- a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
+++ b/test/mjsunit/regress/regress-crbug-390918.js
@@ -4,18 +4,15 @@
 
 // Flags: --allow-natives-syntax
 
-function g() {
-  arguments.length;
-}
-
-var global = "";
+function f(scale) {
+  var arr = {a: 1.1};
 
-function f() {
-  global.dummy = this;
-  g({});
+  for (var i = 0; i < 2; i++) {
+    arr[2 * scale] = 0;
+  }
 }
 
-f();
-f();
+f({});
+f({});
 %OptimizeFunctionOnNextCall(f);
-f();
+f(1004);