Make optimized Function.prototype.apply safe for non-JSObject first arguments.

Make optimized Function.prototype.apply safe for non-JSObject first arguments.

If we have a property access of the form this.x, where the access site sees
the global object, we can specialize the IC stub so that it performs a map
check without first performing a heap object check.

Ensure that we do not get in JS code with a non-JSObject this value by
deoptimizing at Function.prototype.apply if the first argument is not a
JSObject.

BUG=v8:1128
Committed: http://code.google.com/p/v8/source/detail?r=6707

[Mads Ager (chromium), 2011-02-09 16:39:44]

LGTM