1. The write barrier (RecordWriteStub) expects that pointer stored
points to an initialized object. Specifically, the map must be set
before it is stored.

2. The backing store for smi-only elements can only be reused for
double elements if it is in new-space. Otherwise, we need to allocate
a fresh one because the old one is in pointer-space and the new one
has to be in data-space.

BUG=117037
Review URL: https://chromiumcodereview.appspot.com/9633017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00