Fixed deoptimization of inlined getters.

test/mjsunit/regress/regress-crbug-134609.js

Index: test/mjsunit/regress/regress-crbug-134609.js
diff --git a/test/mjsunit/regress/regress-2110.js b/test/mjsunit/regress/regress-crbug-134609.js
similarity index 69%
copy from test/mjsunit/regress/regress-2110.js
copy to test/mjsunit/regress/regress-crbug-134609.js
index d7f78d26a7b4d16c4217d2b0ac136e52e4542eb1..da7d85dcb6514c09bbb63623be7b82043761c5c7 100644
--- a/test/mjsunit/regress/regress-2110.js
+++ b/test/mjsunit/regress/regress-crbug-134609.js
@@ -25,29 +25,35 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --inline-accessors
 
-var uint8 = new Uint8Array(1);
+var forceDeopt = {x:0};
+
+var objectWithGetterProperty = (function (value) {
+  var obj = {};
+  Object.defineProperty(obj, "getterProperty", {
+    get: function foo() {
+      forceDeopt.x;
+      return value;
+    },
+  });
+  return obj;
+})("bad");
 
 function test() {
-  uint8[0] = 0x800000aa;
-  assertEquals(0xaa, uint8[0]);
+  var iAmContextAllocated = "good";
+  objectWithGetterProperty.getterProperty;
+  return iAmContextAllocated;
+
+  // Make sure that the local variable is context allocated.
+  function unused() { iAmContextAllocated; }
 }
 
-test();
-test();
-test();
+assertEquals("good", test());
+assertEquals("good", test());
 %OptimizeFunctionOnNextCall(test);
-test();
-
-var uint32 = new Uint32Array(1);
-
-function test2() {
-  uint32[0] = 0x80123456789abcde;
-  assertEquals(0x789ac000, uint32[0]);
-}
+assertEquals("good", test());
 
-test2();
-test2();
-%OptimizeFunctionOnNextCall(test2);
-test2();
+// At this point, foo should have been inlined into test. Let's deopt...
+delete forceDeopt.x;
+assertEquals("good", test());