Do not embed function in DirectLoadGlobalFunctionPrototype.

src/ic/arm/handler-compiler-arm.cc

Index: src/ic/arm/handler-compiler-arm.cc
diff --git a/src/ic/arm/handler-compiler-arm.cc b/src/ic/arm/handler-compiler-arm.cc
index 8827d36bf26fa50d13601de6b2c212b80fd081c4..c71e948d631447cac7090698c80f7bc1c6e07b28 100644
--- a/src/ic/arm/handler-compiler-arm.cc
+++ b/src/ic/arm/handler-compiler-arm.cc
@@ -140,26 +140,26 @@ void PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
 
 
 void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
-    MacroAssembler* masm, int index, Register prototype, Label* miss) {
+    MacroAssembler* masm, int index, Register prototype, Register scratch,
+    Label* miss) {
   Isolate* isolate = masm->isolate();
   // Get the global function with the given index.
-  Handle<JSFunction> function(
+  Handle<JSFunction> jsfunction(
       JSFunction::cast(isolate->native_context()->get(index)));
-
+  Handle<WeakCell> cell = isolate->factory()->NewWeakCell(jsfunction);
   // Check we're still in the same context.
-  Register scratch = prototype;
+  Register function = prototype;
   const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX);
   __ ldr(scratch, MemOperand(cp, offset));
   __ ldr(scratch, FieldMemOperand(scratch, GlobalObject::kNativeContextOffset));
-  __ ldr(scratch, MemOperand(scratch, Context::SlotOffset(index)));
-  __ Move(ip, function);
-  __ cmp(ip, scratch);
+  __ ldr(function, MemOperand(scratch, Context::SlotOffset(index)));
+  __ CmpWeakValue(function, cell, scratch);
   __ b(ne, miss);
-
   // Load its initial map. The global functions all have initial maps.
-  __ Move(prototype, Handle<Map>(function->initial_map()));
+  __ ldr(scratch,
+         FieldMemOperand(function, JSFunction::kPrototypeOrInitialMapOffset));
   // Load the prototype from the initial map.
-  __ ldr(prototype, FieldMemOperand(prototype, Map::kPrototypeOffset));
+  __ ldr(prototype, FieldMemOperand(scratch, Map::kPrototypeOffset));
 }