Allow new-space JSFunction objects as constant-function properties.

src/ia32/stub-cache-ia32.cc

Index: src/ia32/stub-cache-ia32.cc
===================================================================
--- src/ia32/stub-cache-ia32.cc	(revision 9574)
+++ src/ia32/stub-cache-ia32.cc	(working copy)
@@ -430,7 +430,7 @@
   // -----------------------------------
   // Get the function and setup the context.
   JSFunction* function = optimization.constant_function();
-  __ mov(edi, Immediate(Handle<JSFunction>(function)));
+  __ LoadHeapObject(edi, Handle<JSFunction>(function));
   __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
 
   // Pass the additional arguments.
@@ -1112,7 +1112,7 @@
                                         Register scratch1,
                                         Register scratch2,
                                         Register scratch3,
-                                        Object* value,
+                                        JSFunction* value,
                                         String* name,
                                         Label* miss) {
   // Check that the receiver isn't a smi.
@@ -1122,8 +1122,7 @@
   CheckPrototypes(object, receiver, holder,
                   scratch1, scratch2, scratch3, name, miss);
 
-  // Return the constant value.
-  __ mov(eax, Handle<Object>(value));
+  __ LoadHeapObject(eax, Handle<JSFunction>(value));
   __ ret(0);
 }
 
@@ -2879,7 +2878,7 @@
 
 MaybeObject* LoadStubCompiler::CompileLoadConstant(JSObject* object,
                                                    JSObject* holder,
-                                                   Object* value,
+                                                   JSFunction* value,
                                                    String* name) {
   // ----------- S t a t e -------------
   //  -- eax    : receiver
@@ -3052,7 +3051,7 @@
 MaybeObject* KeyedLoadStubCompiler::CompileLoadConstant(String* name,
                                                         JSObject* receiver,
                                                         JSObject* holder,
-                                                        Object* value) {
+                                                        JSFunction* value) {
   // ----------- S t a t e -------------
   //  -- eax    : key
   //  -- edx    : receiver