Fix GC stress after r52416

Allocating elements and/or property backing stores can, due to retrying,
cause a JSObject that has just been allocated in new space to be promoted
to old space, so skipping the write barrier is now an invalid optimization.

Tbr: hpayer@chromium.org
Change-Id: I4a1eacbd59912dd4aa9069b0636f683fb4674231
Reviewed-on: https://chromium-review.googlesource.com/998799Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52417}

src/heap/factory.cc

@@ -1755,13 +1755,13 @@ Handle<JSObject> Factory::CopyJSObjectWithAllocationSite(
       // TODO(gsathya): Do not copy hash code.
       Handle<PropertyArray> prop = CopyArrayWithMap(
           handle(properties, isolate()), handle(properties->map(), isolate()));
-      clone->set_raw_properties_or_hash(*prop, SKIP_WRITE_BARRIER);
+      clone->set_raw_properties_or_hash(*prop);
     }
   } else {
     Handle<FixedArray> properties(
         FixedArray::cast(source->property_dictionary()), isolate());
     Handle<FixedArray> prop = CopyFixedArray(properties);
-    clone->set_raw_properties_or_hash(*prop, SKIP_WRITE_BARRIER);
+    clone->set_raw_properties_or_hash(*prop);
   }
   return clone;
 }