Fix Array.length, String.length and Function.prototype LoadICs on x64.

test/mjsunit/regress/regress-2568.js

Index: test/mjsunit/regress/regress-2568.js
diff --git a/test/mjsunit/deopt-minus-zero.js b/test/mjsunit/regress/regress-2568.js
similarity index 70%
copy from test/mjsunit/deopt-minus-zero.js
copy to test/mjsunit/regress/regress-2568.js
index ee0983127dc3ae10311cf11a88ba40284e366dfe..235183e337450a2b031db82063b2a1cf67e87469 100644
--- a/test/mjsunit/deopt-minus-zero.js
+++ b/test/mjsunit/regress/regress-2568.js
@@ -25,32 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc
-
-/**
- * The possible optimization states of a function. Must be in sync with the
- * return values of Runtime_GetOptimizationStatus() in runtime.cc!
- */
-var OptimizationState = {
-    YES: 1,
-    NO: 2,
-    ALWAYS: 3,
-    NEVER: 4
+function pluck1(a, key) {
+    return a.map(function(item) { return item[key]; });
 };
+assertArrayEquals([2, 2], pluck1([[0, 0], [0, 0]], 'length'));
+assertArrayEquals([1, 3], pluck1([[1, 2], [3, 4]], '0'));
 
-function mul (a, b) {
-  return a * b;
-}
-
-mul(-1, -1);
-mul(0x80000001|0, -1);
-mul(0x80000001|0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
-
-var raw_optimized = %GetOptimizationStatus(mul);
-assertFalse(raw_optimized == OptimizationState.NO);
-gc();
+function pluck2(a, key) {
+    return a.map(function(item) { return item[key]; });
+};
+assertArrayEquals([2, 2], pluck2(["ab", "cd"], 'length'));
+assertArrayEquals(["a", "c"], pluck2(["ab", "cd"], '0'));
 
+function pluck3(a, key) {
+    return a.map(function(item) { return item[key]; });
+};
+f = function() { 1 };
+f.prototype = g = function() { 2 };
+assertArrayEquals([g, g], pluck3([f, f], 'prototype'));
+assertArrayEquals([undefined, undefined], pluck3([f, f], '0'));