Skip the write barrier for global property cell writes. The heap...

src/objects-inl.h

Index: src/objects-inl.h
===================================================================
--- src/objects-inl.h	(revision 2419)
+++ src/objects-inl.h	(working copy)
@@ -1062,8 +1062,17 @@
 ACCESSORS(Oddball, to_number, Object, kToNumberOffset)
 
 
-ACCESSORS(JSGlobalPropertyCell, value, Object, kValueOffset)
+Object* JSGlobalPropertyCell::value() {
+  return READ_FIELD(this, kValueOffset);
+}
 
+
+void JSGlobalPropertyCell::set_value(Object* val, WriteBarrierMode ignored) {
+  // The write barrier is not used for global property cells.
+  WRITE_FIELD(this, kValueOffset, val);
+}
+
+
 int JSObject::GetHeaderSize() {
   switch (map()->instance_type()) {
     case JS_GLOBAL_PROXY_TYPE: