[GC] Align behavior of JSProxy with JSObject when embedded in optimized code

[GC] Align behavior of JSProxy with JSObject when embedded in optimized code

With --harmony-proxies enabled, embedded pointers in optimized code can point to
a JSProxy (via a cell). Since JSProxy can morph into JSObject we need to align
the expectations of weak vs strong refs.

With this patch we also treat JSPRoxy as weak ref (like JSObject) and therefore
properly record a dependency on it, so that once the cell pointing to it becomes
unreachable we deoptimize the corresponding code.

BUG=v8:4359
LOG=N

Committed: https://crrev.com/a039ff2930cbe6881360925e4debc959c7db392a
Cr-Commit-Position: refs/heads/master@{#30067}

[Michael Lippautz, 2015-08-07 12:20:16]

mlippautz@chromium.org changed reviewers:
+ hpayer@chromium.org, ulan@chromium.org

[Michael Lippautz, 2015-08-07 12:20:16]

Fixes the issue Yang was seeing in v8:4359.

[ulan, 2015-08-07 12:22:42]

LGTM, good catch!

[Hannes Payer (out of office), 2015-08-07 12:26:08]

On 2015/08/07 12:22:42, ulan wrote:
> LGTM, good catch!

Lgtm

[Michael Lippautz, 2015-08-07 12:26:26]

The CQ bit was checked by mlippautz@chromium.org

[commit-bot: I haz the power, 2015-08-07 12:26:30]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1270393003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1270393003/1

[commit-bot: I haz the power, 2015-08-07 12:54:54]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-08-07 12:55:12]

Patchset 1 (id:??) landed as
https://crrev.com/a039ff2930cbe6881360925e4debc959c7db392a
Cr-Commit-Position: refs/heads/master@{#30067}