Use safe version (i.e. using write barrier) of set_map in ReinitializeJSReceiver.

We pass in the object that we set the map on.
Review URL: http://codereview.chromium.org/8486005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/heap.cc

@@ -3846,7 +3846,7 @@ MaybeObject* Heap::ReinitializeJSReceiver(
   // we must NOT fail after this point, where we have changed the type!
 
   // Reset the map for the object.
-  object->set_map_unsafe(map);
+  object->set_map(map);
   JSObject* jsobj = JSObject::cast(object);
 
   // Reinitialize the object from the constructor map.