Do not emit Simulates in HandlePolymorphicElementAccess.

test/mjsunit/regress/regress-2653.js

Index: test/mjsunit/regress/regress-2653.js
diff --git a/test/mjsunit/regress/regress-crbug-217858.js b/test/mjsunit/regress/regress-2653.js
similarity index 78%
copy from test/mjsunit/regress/regress-crbug-217858.js
copy to test/mjsunit/regress/regress-2653.js
index 8563e07eee9e1acbcdc8c5c28c461f2d27fad6f1..eb0c6315e6ae5c3d6526398efc03c0d6f5ce5388 100644
--- a/test/mjsunit/regress/regress-crbug-217858.js
+++ b/test/mjsunit/regress/regress-2653.js
@@ -25,16 +25,23 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --deopt_every_n_garbage_collections=1
 
-var r = /r/;
-var a = "";
-function f() {
-  %OptimizeFunctionOnNextCall(f, "osr");
-  for (var i = 0; i < 1000000; i++) {
-    a += i.toString();
-    r[r] = function() {};
+function foo(a, b) {
+  var l = a.length;
+  var array = new Array(l);
+  for (var k = 0; k < l; k++) {
+    array[k] = 120;
   }
+  var result = new Array(l);
+  for (var i = 0; i < l; i++) {
+    result[i] = array[i];
+  }
+  return result;
 }
 
-f();
+a = "xxxxxxxxxxxxxxxxxxxxxxxxx";
+while (a.length < 100000) a = a + a;
+foo(a, []);
+%OptimizeFunctionOnNextCall(foo)
+foo(a, []);