[strong] fix strong array, object prototypes

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 10350 matching lines @@
 
       // If the function is used as the global Array function, cache the
       // updated initial maps (and transitioned versions) in the native context.
       Handle<Context> native_context(function->context()->native_context(),
                                      isolate);
       Handle<Object> array_function(
           native_context->get(Context::ARRAY_FUNCTION_INDEX), isolate);
       if (array_function->IsJSFunction() &&
           *function == JSFunction::cast(*array_function)) {
         CacheInitialJSArrayMaps(native_context, new_map);
-        Handle<Map> new_strong_map =
-            Map::Copy(initial_map, "SetInstancePrototype");
+        Handle<Map> new_strong_map = Map::Copy(new_map, "SetInstancePrototype");
         new_strong_map->set_is_strong();
         CacheInitialJSArrayMaps(native_context, new_strong_map);
       }
     }
 
     // Deoptimize all code that embeds the previous initial map.
     initial_map->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kInitialMapChangedGroup);
   } else {
     // Put the value in the initial map field until an initial map is
@@ skipping 6964 matching lines @@
 void PropertyCell::SetValueWithInvalidation(Handle<PropertyCell> cell,
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 } }  // namespace v8::internal