Fix marking of prototype objects in chain

With a real prototype chain it can happen that an internal class' prototype's
class itself has a prototype. Therefore the first transition on the empty class
is a PrototypeChange one, but the class the transition leads to may have
PrototypeChange transitions itself, which weren't marked.

There are multiple solutions to this, but this patch is the minimal fix by
recursing fully through the internal class tree. That way it's easier to
back-port the fix also into 5.2.x based branches.

Task-number: QTBUG-37834

Change-Id: I901b13a2663fbad5844003ca5752f2f304de320c
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

Conflicts:
	tests/auto/qml/qjsengine/tst_qjsengine.cpp
Fix wrong register usage for integer binops

When doing of integers where we use a three argument variant of masm
(lhs/rhs/target), we need three general purpose registers. If the target temp
of the binop is a register, we use that as a target, otherwise fall back to
ReturnValueRegister (scratch). In that case we don't need to move from RVR to
target register. Additionally we need to load lhs and rhs into registers, and
for the lhs we use the target register and for the rhs the scratch register.

So we start by loading the lhs into the target register and the rhs into
the scratch register. However if the rhs is already assigned to a register
and that register happens to be the target register, then the earlier load
of the lhs into the target register overwrote our rhs!

This is fixed by being more careful in the choice of the target temp's assigned
register as "scratch" register for the lhs, i.e. don't use it if the target
temp is also assigned to the same register as the rhs.

Task-number: QTBUG-38097
Change-Id: I2ffec55cb98818fa9ebb5a76a32b6dca72175893
Reviewed-by: Lars Knoll <lars.knoll@digia.com>