Fix (non-intrinsic) UnsafeCASObject for the read barrier config.

Make sure the field contains a to-space reference before attempting the
CAS with a special read barrier to avoid an incorrect CAS failure.

This is only about the non-intrinsic UnsafeCASObject.

This seems to fix some jsr166 test failures.

Also, remove the unused template parameter kMaybeDuringStartup.

Bug: 25883050
Bug: 12687968

Change-Id: Ia6f0d882fa3d90c42f14968672d547babcdf6309
diff --git a/runtime/image.cc b/runtime/image.cc
index 7d2ef75..f8f930b 100644
--- a/runtime/image.cc
+++ b/runtime/image.cc
@@ -126,7 +126,7 @@
   mirror::ObjectArray<mirror::Object>* image_roots =
       reinterpret_cast<mirror::ObjectArray<mirror::Object>*>(image_roots_);
   mirror::ObjectArray<mirror::Object>* result =
-      ReadBarrier::BarrierForRoot<mirror::ObjectArray<mirror::Object>, kWithReadBarrier, true>(
+      ReadBarrier::BarrierForRoot<mirror::ObjectArray<mirror::Object>, kWithReadBarrier>(
           &image_roots);
   DCHECK_EQ(image_roots, result);
   return result;