3.20 branch: Fix HObjectAccess for loads from migrating prototypes

test/mjsunit/regress/regress-crbug-305309.js

Index: test/mjsunit/regress/regress-crbug-305309.js
diff --git a/test/mjsunit/constant-compare-nil-value.js b/test/mjsunit/regress/regress-crbug-305309.js
similarity index 80%
copy from test/mjsunit/constant-compare-nil-value.js
copy to test/mjsunit/regress/regress-crbug-305309.js
index 9f5b2adb063abc0c7920d8dee30edb7ee6eb1ff9..cd89bedc112002b776ff5dc6f6e41571e81b5bc0 100644
--- a/test/mjsunit/constant-compare-nil-value.js
+++ b/test/mjsunit/regress/regress-crbug-305309.js
@@ -27,16 +27,23 @@
 
 // Flags: --allow-natives-syntax
 
-function inlined() {
-    return 1;
+function BadProto() {
+  this.constant_function = function() {};
+  this.one = 1;
+  this.two = 2;
 }
+var b1 = new BadProto();
+var b2 = new BadProto();
 
-function foo() {
-    if ((inlined() + 0.5) == null) return "null";
-    return "non-null";
-}
+function Ctor() {}
+Ctor.prototype = b1;
+var a = new Ctor();
 
-assertEquals("non-null", foo());
-assertEquals("non-null", foo());
-%OptimizeFunctionOnNextCall(foo);
-assertEquals("non-null", foo());
+function Two(x) {
+  return x.two;
+}
+assertEquals(2, Two(a));
+assertEquals(2, Two(a));
+b2.constant_function = "no longer constant!";
+%OptimizeFunctionOnNextCall(Two);
+assertEquals(2, Two(a));