Add regression test case for http://crbug.com/16276. Crashes

in both debug and release mode before r2435, but not after.
Review URL: http://codereview.chromium.org/155491

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

test/cctest/test-api.cc

@@ -7081,3 +7081,21 @@ THREADED_TEST(ReplaceConstantFunction) {
   obj_clone->Set(foo_string, v8::String::New("Hello"));
   CHECK(!obj->Get(foo_string)->IsUndefined());
 }
+
+
+// Regression test for http://crbug.com/16276.
+THREADED_TEST(Regress16276) {
+  v8::HandleScope scope;
+  LocalContext context;
+  // Force the IC in f to be a dictionary load IC.
+  CompileRun("function f(obj) { return obj.x; }\n"
+             "var obj = { x: { foo: 42 }, y: 87 };\n"
+             "var x = obj.x;\n"
+             "delete obj.y;\n"
+             "for (var i = 0; i < 5; i++) f(obj);");
+  // Detach the global object to make 'this' refer directly to the
+  // global object (not the proxy), and make sure that the dictionary
+  // load IC doesn't mess up loading directly from the global object.
+  context->DetachGlobal();
+  CHECK_EQ(42, CompileRun("f(this).foo")->Int32Value());
+}