Abort optimization in corner case.

test/mjsunit/regress/regress-436893.js

Index: test/mjsunit/regress/regress-436893.js
diff --git a/test/mjsunit/regress/regress-346343.js b/test/mjsunit/regress/regress-436893.js
similarity index 88%
copy from test/mjsunit/regress/regress-346343.js
copy to test/mjsunit/regress/regress-436893.js
index e4c10663138db599a682880df98f3310e0754b63..38e7b5fb86cbe67144956f45f69650b71d399466 100644
--- a/test/mjsunit/regress/regress-346343.js
+++ b/test/mjsunit/regress/regress-436893.js
@@ -1,4 +1,4 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
+// Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -27,16 +27,11 @@
 
 // Flags: --allow-natives-syntax
 
-function f(o) {
-  for (var i = 1; i < 2; ++i) {
-    var y = o.y;
-  }
+var x = 11;
+function foo() {
+  return 42;
 }
-f({y:1.1});
-f({y:1.1});
-
-function g(x) { f({z:x}); }
-g(1);
-g(2);
+// Test passing null or undefined as receiver.
+function g() { return foo.apply(null, x()++); }
 %OptimizeFunctionOnNextCall(g);
-g(1);
+assertThrows(g);