Bugfix: make dependent code field in AllocationSite weak.

test/mjsunit/regress/regress-320532.js

Index: test/mjsunit/regress/regress-320532.js
diff --git a/test/mjsunit/regress/regress-264203.js b/test/mjsunit/regress/regress-320532.js
similarity index 81%
copy from test/mjsunit/regress/regress-264203.js
copy to test/mjsunit/regress/regress-320532.js
index fa0075662575d85241b6af82c5945cca32938991..0730721a33183c25d5645de58bc0a4861acc98c1 100644
--- a/test/mjsunit/regress/regress-264203.js
+++ b/test/mjsunit/regress/regress-320532.js
@@ -24,21 +24,19 @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
+// Flags: --track-allocation-sites --noalways-opt
+// Flags: --stress-runs=8 --send-idle-notification --gc-global
 
-// Flags: --allow-natives-syntax
-
-function foo(x) {
-  var a = [1, 2, 3, 4, 5, 6, 7, 8];
-  a[x + 5];
-  var result;
-  for (var i = 0; i < 3; i++) {
-    result = a[0 - x];
-  }
-  return result;
-}
 
+function bar() { return new Array(); }
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+a = bar();
+function foo(len) { return new Array(len); }
+foo(0);
 foo(0);
+%OptimizeFunctionOnNextCall(bar);
 foo(0);
-%OptimizeFunctionOnNextCall(foo);
-var r = foo(-2);
-assertEquals(3, r);