Fix potentially GC unsafe place in JSObject::DeleteElementWithInterceptor.

Review URL: http://codereview.chromium.org/7660012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -3167,7 +3167,8 @@ MaybeObject* JSObject::DeleteElementWithInterceptor(uint32_t index) {
     ASSERT(result->IsBoolean());
     return *v8::Utils::OpenHandle(*result);
   }
-  MaybeObject* raw_result = GetElementsAccessor()->Delete(*this_handle,
+  MaybeObject* raw_result = this_handle->GetElementsAccessor()->Delete(
+      *this_handle,
       index,
       NORMAL_DELETION);
   RETURN_IF_SCHEDULED_EXCEPTION(isolate);