Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map.

test/mjsunit/regress/regress-crbug-436820.js

Index: test/mjsunit/regress/regress-crbug-436820.js
diff --git a/test/mjsunit/regress/regress-409533.js b/test/mjsunit/regress/regress-crbug-436820.js
similarity index 61%
copy from test/mjsunit/regress/regress-409533.js
copy to test/mjsunit/regress/regress-crbug-436820.js
index e51065e4bf43f8c8ca222c458c85a96f003996a2..eea386ce1854ab408f7d6fa1dd5c5682ddd24b71 100644
--- a/test/mjsunit/regress/regress-409533.js
+++ b/test/mjsunit/regress/regress-crbug-436820.js
@@ -4,10 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f() {
-  %_RegExpConstructResult(0, {}, {});
+function c(p) {
+  return {__proto__: p};
 }
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var p = {};
+var o = c(p);
+p.x = 0.6;
+Object.defineProperty(p, "x", { writable: false });