This fixes two places that used the marking write barrier for elements
instead of the new marking write barrier for descriptor array.

This also ensures that revisited objects are marked black.

Bug: v8:8651,chromium:917794
Change-Id: Ifc17ff89686f32ccf61d4b3f764b0ab536c42912
Reviewed-on: https://chromium-review.googlesource.com/c/1406670Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58742}