Merge r8390 from bleeding edge (fix missing write barrier in arguments IC).

test/mjsunit/arguments-escape.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 22 matching lines @@
   };
   bar(1);
   bar(2);
   bar(3);
   return bar;
 }
 var baz = foo(0);
 baz(4);
 baz(5);
 baz(6);
+
+// Test writing a non-smi.
+function foo2(x) {
+  var a = arguments;
+  function bar2(i) {
+    assertEquals(i, ++a[0]);
+    assertEquals(i, x);
+  };
+  bar2(1.5);
+  bar2(2.5);
+  bar2(3.5);
+  return bar2;
+}
+var baz2 = foo2(0.5);
+baz2(4.5);
+baz2(5.5);
+baz2(6.5);