Fix loading non-configurable non-writable value from a constant with mismatching type feedback

test/mjsunit/regress/regress-inline-constant-load.js

Index: test/mjsunit/regress/regress-inline-constant-load.js
diff --git a/test/mjsunit/regress/regress-inline-constant-load.js b/test/mjsunit/regress/regress-inline-constant-load.js
new file mode 100644
index 0000000000000000000000000000000000000000..303639c74f0840f8af6b69ff7b01e9f364716ebe
--- /dev/null
+++ b/test/mjsunit/regress/regress-inline-constant-load.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+  return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+  var o = o2;
+  if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));