Only fold polymorphic into monomorphic load if all load from either receiver or same prototype.

test/mjsunit/regress/regress-polymorphic-load.js

Index: test/mjsunit/regress/regress-polymorphic-load.js
diff --git a/test/mjsunit/regress/regress-2671.js b/test/mjsunit/regress/regress-polymorphic-load.js
similarity index 91%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-polymorphic-load.js
index 8da1b8f07f69c487fe9913e485c60f3e257e0986..2545e85f60a2c7fe8f68dd9c667e38a0528ff127 100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-polymorphic-load.js
@@ -27,19 +27,17 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
-function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i] = 1/y;
-  assertFalse(isNaN(a[i]));
+function f(o) {
+  return o.x;
 }
 
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+var o1 = {x:1};
+var o2 = {__proto__: {x:2}};
 
+f(o2);
+f(o2);
+f(o2);
+f(o1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(o1));
+assertEquals(2, f(o2));