Merged r16150, r16174, r16175 into 3.19 branch.

Fix regressions triggered by map invalidation during graph creation.

Fix bug in HPhi::SimplifyConstantInput.

Use Cell instead of PropertyCell in DoCheckFunction (in case of new space object).

R=jkummerow@chromium.org
BUG=269679

Review URL: https://codereview.chromium.org/22984009

git-svn-id: https://v8.googlecode.com/svn/branches/3.19@16217 ce2b1a6d-e550-0410-aec6-3dcde31c8c00