Infer HConstant::NotInNewSpace only if the supplied handle is null.

test/mjsunit/regress/regress-449291.js

Index: test/mjsunit/regress/regress-449291.js
diff --git a/test/mjsunit/array-push12.js b/test/mjsunit/regress/regress-449291.js
similarity index 67%
copy from test/mjsunit/array-push12.js
copy to test/mjsunit/regress/regress-449291.js
index f4c15b484b41197c9007113ecf8f91fe909cc5d3..fb56027b67f3f176f1432c11b39075aec6cc8429 100644
--- a/test/mjsunit/array-push12.js
+++ b/test/mjsunit/regress/regress-449291.js
@@ -4,20 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-var a = [];
-for (var i = -20; i < 0; ++i) {
-  a[i] = 0;
-}
-
-function g() {
-    [].push.apply(a, arguments);
-}
+a = {y:1.5};
+a.y = 1093445778;
+b = a.y;
+c = {y:{}};
 
 function f() {
-  g();
+  return {y: b};
 }
 
-g();
-g();
-%OptimizeFunctionOnNextCall(f);
 f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f().y, 1093445778);