There's a typo in a couple of lithium backends, where we assume that the
array protector on the Isolate is a Cell instead of a PropertyCell. This
could lead to unnecessary deoptimizations.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2512943002
Cr-Commit-Position: refs/heads/master@{#41096}