[crankshaft] Fix HAliasAnalyzer for constants

BUG=chromium:722756

Change-Id: I04fc7fa0b8ef1e56d25f829fc5c8f53ae439aa52
Reviewed-on: https://chromium-review.googlesource.com/507209Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45375}

src/crankshaft/hydrogen-alias-analysis.h

@@ -43,7 +43,7 @@ class HAliasAnalyzer : public ZoneObject {
     }
 
     // Constant objects can be distinguished statically.
-    if (a->IsConstant()) {
+    if (a->IsConstant() && b->IsConstant()) {
       return a->Equals(b) ? kMustAlias : kNoAlias;
     }
     return kMayAlias;

test/mjsunit/regress/regress-crbug-722756.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var array = [[{}], [1.1]];
+
+function transition() {
+  for(var i = 0; i < array.length; i++){
+    var arr = array[i];
+    arr[0] = {};
+  }
+}
+
+var double_arr2 = [1.1,2.2];
+
+var flag = 0;
+function swap() {
+  try {} catch(e) {}  // Prevent Crankshaft from inlining this.
+  if (flag == 1) {
+    array[1] = double_arr2;
+  }
+}
+
+var expected = 6.176516726456e-312;
+function f(){
+  swap();
+  double_arr2[0] = 1;
+  transition();
+  double_arr2[1] = expected;
+}
+
+for(var i = 0; i < 3; i++) {
+  f();
+}
+%OptimizeFunctionOnNextCall(f);
+flag = 1;
+f();
+assertEquals(expected, double_arr2[1]);