Function load

deps/v8/test/mjsunit/keyed-load-null-receiver.js:6–15

(a)

var count = 0;
function load(a) {
  var prop = {
    toString: function() {
      count++;
      return 'z';
    }
  };

  a[prop] ^= 1;
}

function f(null_or_undefined) {
  // Turn the LoadIC megamorphic