Fix invalid reuse of weak global handle in GetScriptWrapper.

test/mjsunit/regress/regress-2988.js

Index: test/mjsunit/regress/regress-2988.js
diff --git a/test/mjsunit/regress/regress-map-invalidation-1.js b/test/mjsunit/regress/regress-2988.js
similarity index 78%
copy from test/mjsunit/regress/regress-map-invalidation-1.js
copy to test/mjsunit/regress/regress-2988.js
index bcc6bbb615a1286248271bcf58e998fb9724154c..0311d2b76ded60d53a4627aa271d8c6d24bcdf36 100644
--- a/test/mjsunit/regress/regress-map-invalidation-1.js
+++ b/test/mjsunit/regress/regress-2988.js
@@ -25,24 +25,15 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --gc-global --throws
 
-var c = { x: 2, y: 1 };
+var f = eval("(function f() { throw 'kaboom'; })");
 
-function h() {
-  %MigrateInstance(c);
-  return 2;
-}
-%NeverOptimizeFunction(h);
-
-function f() {
-  for (var i = 0; i < 100000; i++) {
-    var n = c.x + h();
-    assertEquals(4, n);
-  }
-  var o2 = [{ x: 2.5, y:1 }];
-  return o2;
-}
+// Prepare that next MessageHandler::MakeMessageObject will result in
+// reclamation of existing script wrapper while weak handle is used.
+%FunctionGetScript(f);
+%SetAllocationTimeout(1000, 2);
 
+// This call throws to the console but the --throws flag passed to this
+// test will make sure we don't count it as an actual failure.
 f();
-