Change inlined cache of intanceof stub to use indirection through cell.

Change inlined cache of intanceof stub to use indirection through cell.

The stub was directly patching caller's code without issuing write barrier which violated incremental marking invariants.

R=mstarzinger@chromium.org
BUG=http://crbug.com/109448
TEST=cctest/test-heap/InstanceOfStubWriteBarrier

Committed: http://code.google.com/p/v8/source/detail?r=10380

[Michael Starzinger, 2012-01-11 09:35:09]

LGTM (with a nit).

http://codereview.chromium.org/9158015/diff/1/src/arm/lithium-codegen-arm.cc
File src/arm/lithium-codegen-arm.cc (right):

http://codereview.chromium.org/9158015/diff/1/src/arm/lithium-codegen-arm.cc#...
src/arm/lithium-codegen-arm.cc:2145:
isolate()->factory()->NewJSGlobalPropertyCell(
Can we use factory() instead of isolate()->factory() here? Makes the line
shorter.

http://codereview.chromium.org/9158015/diff/1/test/cctest/test-heap.cc
File test/cctest/test-heap.cc (right):

http://codereview.chromium.org/9158015/diff/1/test/cctest/test-heap.cc#newcod...
test/cctest/test-heap.cc:1497: "f(new foo()); g();");
As discussed offline, the call to g() could probably be removed at this point.
But Slava and I agreed that we should leave it in to not mess with the original
repro.