Minor bugfix in building inlined Array: bad argument to JSArrayBuilder.

Minor bugfix in building inlined Array: bad argument to JSArrayBuilder.

An HConstant pointing to a Cell rather than an AllocationSite
was passed. The argument wasn't used because of fortuitous
flags. An assert was added to protect the argument.

R=bmeurer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18666

[mvstanton, 2014-01-17 11:40:27]

Hi Benedikt, I noticed a small bug, can you take a look? thx,
--Michael

[Benedikt Meurer, 2014-01-17 11:41:06]

LGTM

[mvstanton, 2014-01-17 12:19:05]

Committed patchset #1 manually as r18666 (presubmit successful).