Temporarily disable optimization for StringWrappers to use native valueOf

Temporarily disable optimization for StringWrappers to use native valueOf

V8 stores this information directly in the map of the wrapper, however,
it is not invalidated when the prototype of the wrapper is changed, so
once the bit is set, it is no longer possible to override valueOf.

This bug is currently hidden in Chrome since the i18n extension always
modifies the String.prototype, and so the optimization never kicks in.
Disabling the optimization temporarily allows for snapshotting i18n now.

BUG=v8:2855
R=yangguo@chromium.org
TEST=mjsunit/regress/regress-2855.js

Committed: https://code.google.com/p/v8/source/detail?r=16292

[Yang, 2013-08-23 11:30:00]

On 2013/08/23 05:54:31, jochen wrote:

LGTM.

FYI I'm already working on a better fix of this.

[jochen (gone - plz use gerrit), 2013-08-23 11:31:40]

Committed patchset #2 manually as r16292.