[turbofan] Ensure that all prototypes are stable for push/pop.

[turbofan] Ensure that all prototypes are stable for push/pop.

When lowering Array.prototype.push/.pop to the fast inlined version, we
first need to ensure that all prototypes (including the Object.prototype)
are stable.

R=mvstanton@chromium.org
BUG=chromium:644689
Committed: https://crrev.com/4ed27fc836acfc3218a5e4ce6d878a513e9df788
Cr-Commit-Position: refs/heads/master@{#39266}

[Benedikt Meurer, 2016-09-08 04:35:06]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-08 04:35:14]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-09-08 04:36:13]

Hey Michael,

We didn't properly check the Object.prototype for the Array resize operations.
Please take a look.

Thanks,
Benedikt

[commit-bot: I haz the power, 2016-09-08 04:57:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-08 04:57:45]

Dry run: This issue passed the CQ dry run.

[mvstanton, 2016-09-08 07:59:31]

lgtm

[Benedikt Meurer, 2016-09-08 08:46:38]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-09-08 08:46:42]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-08 08:48:22]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-09-08 08:48:39]

Description was changed from

==========
[turbofan] Ensure that all prototypes are stable for push/pop.

When lowering Array.prototype.push/.pop to the fast inlined version, we
first need to ensure that all prototypes (including the Object.prototype)
are stable.

R=mvstanton@chromium.org
BUG=chromium:644689
==========

to

==========
[turbofan] Ensure that all prototypes are stable for push/pop.

When lowering Array.prototype.push/.pop to the fast inlined version, we
first need to ensure that all prototypes (including the Object.prototype)
are stable.

R=mvstanton@chromium.org
BUG=chromium:644689

Committed: https://crrev.com/4ed27fc836acfc3218a5e4ce6d878a513e9df788
Cr-Commit-Position: refs/heads/master@{#39266}
==========

[commit-bot: I haz the power, 2016-09-08 08:48:40]

Patchset 1 (id:??) landed as
https://crrev.com/4ed27fc836acfc3218a5e4ce6d878a513e9df788
Cr-Commit-Position: refs/heads/master@{#39266}