Rubber stamped by Filip Pizlo.

Source/JavaScriptCore: 

* heap/CopyVisitorInlines.h:
(JSC::CopyVisitor::visitItem):

LayoutTests: 

Added a new test that triggered the old ASSERT. It's a useful test to have because we create
TypedArrays with custom properties.

* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented-expected.txt: Added.
* fast/js/regress/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.html: Added.
* fast/js/regress/script-tests/ArrayBuffer-Int8Array-alloc-large-long-lived-fragmented.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154407 268f45cc-cd09-0410-ab3c-d52691b4dbfc