Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136.

test/mjsunit/regress/regress-crbug-430846.js

Index: test/mjsunit/regress/regress-crbug-430846.js
diff --git a/test/mjsunit/regress/regress-3392.js b/test/mjsunit/regress/regress-crbug-430846.js
similarity index 53%
copy from test/mjsunit/regress/regress-3392.js
copy to test/mjsunit/regress/regress-crbug-430846.js
index 375f30210ce11272799c78b51463d97fc6b65998..3047c7fc34202b42f71ee78cd19d6ade0df62349 100644
--- a/test/mjsunit/regress/regress-3392.js
+++ b/test/mjsunit/regress/regress-crbug-430846.js
@@ -4,15 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() {
-  var a = {b: -1.5};
-  for (var i = 0; i < 1; i++) {
-    a.b = 1;
-  }
-  assertTrue(0 <= a.b);
-}
+function foo() { return 1; };
+var o1 = {};
+o1.foo = foo;
 
-foo();
-foo();
-%OptimizeFunctionOnNextCall(foo);
-foo();
+var json = '{"foo": {"x": 1}}';
+var o2 = JSON.parse(json);
+var o3 = JSON.parse(json);
+assertTrue(%HaveSameMap(o2, o3));