Handlify JSObject::MigrateInstance and friends.

This relands the original change from r16899 together with a bugfix for
two unhandlified values which became stale.

R=verwaest@chromium.org
TEST=mjsunit/debug-evaluate-locals-optimized (in GC stress mode)

Review URL: https://codereview.chromium.org/24210011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@16905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00