Fix IC handler cache clearing for JSBuiltinsObject

Fix IC handler cache clearing for JSBuiltinsObject

The clearing mechanism relies on comparing the cached handler with the installed handler. If we try to preserve monomorphism by pretending that the IC was in uninitialized state, then it will go premonomorphic first, which means on the next miss there's no installed handler available to compare against. Instead, pretend it was premonomorphic, so the comparison will happen right away, will fail as it should, and the cached handler will be cleared.

Thanks to Weiliang for starting the investigation that led to this.

R=verwaest@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/c177910d92e413adbf18c313ccfbc30cad3eb1f3

[Jakob Kummerow, 2014-11-18 13:32:19]

jkummerow@chromium.org changed reviewers:
+ verwaest@chromium.org

[Jakob Kummerow, 2014-11-18 13:32:20]

Toon: PTAL.

Weiliang: FYI.

[Toon Verwaest, 2014-11-18 13:35:04]

lgtm

[Jakob Kummerow, 2014-11-18 13:35:54]

Committed patchset #1 (id:1) manually as
c177910d92e413adbf18c313ccfbc30cad3eb1f3 (presubmit successful).