Allow new-space JSFunction objects as constant-function properties.

src/objects-inl.h

Index: src/objects-inl.h
===================================================================
--- src/objects-inl.h	(revision 9574)
+++ src/objects-inl.h	(working copy)
@@ -1901,10 +1901,10 @@
 }
 
 
-void DescriptorArray::fast_swap(FixedArray* array, int first, int second) {
+void DescriptorArray::swap_elements(FixedArray* array, int first, int second) {
   Object* tmp = array->get(first);
-  fast_set(array, first, array->get(second));
-  fast_set(array, second, tmp);
+  array->set(first, array->get(second));
+  array->set(second, tmp);
 }
 
 
@@ -2016,15 +2016,11 @@
   // Range check.
   ASSERT(descriptor_number < number_of_descriptors());
 
-  // Make sure none of the elements in desc are in new space.
-  ASSERT(!HEAP->InNewSpace(desc->GetKey()));
-  ASSERT(!HEAP->InNewSpace(desc->GetValue()));
-
-  fast_set(this, ToKeyIndex(descriptor_number), desc->GetKey());
+  set(ToKeyIndex(descriptor_number), desc->GetKey());
   FixedArray* content_array = GetContentArray();
-  fast_set(content_array, ToValueIndex(descriptor_number), desc->GetValue());
-  fast_set(content_array, ToDetailsIndex(descriptor_number),
-           desc->GetDetails().AsSmi());
+  content_array->set(ToValueIndex(descriptor_number), desc->GetValue());
+  content_array->set(ToDetailsIndex(descriptor_number),
+                     desc->GetDetails().AsSmi());
 }
 
 
@@ -2036,10 +2032,10 @@
 
 
 void DescriptorArray::Swap(int first, int second) {
-  fast_swap(this, ToKeyIndex(first), ToKeyIndex(second));
+  swap_elements(this, ToKeyIndex(first), ToKeyIndex(second));
   FixedArray* content_array = GetContentArray();
-  fast_swap(content_array, ToValueIndex(first), ToValueIndex(second));
-  fast_swap(content_array, ToDetailsIndex(first),  ToDetailsIndex(second));
+  swap_elements(content_array, ToValueIndex(first), ToValueIndex(second));
+  swap_elements(content_array, ToDetailsIndex(first),  ToDetailsIndex(second));
 }