Fix crash involving zombie maps escaping from the JSON parser's underground lab

Zapping is required since transition arrays contain weak references to maps: At the end of a GC cycle, ClearNonLiveTransitions removes references to dead maps from transition arrays. If a marked transition array with weak (dead) references is replaced by another transition array before the end of the GC cycle, dead references are not removed from the replaced transition array. If the replaced transition array is kept alive by a handle, marking will crash when trying to mark the first reference to a dead map.

Review URL: https://codereview.chromium.org/12987013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix store_mode bug involving polymorphism with external and JS arrays.

Review URL: https://codereview.chromium.org/12987014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Generalizing remaining Allocate functions in the macro assemblers used in pretenuring.

BUG=

Review URL: https://codereview.chromium.org/12440041

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add AssertNoAllocation to ensure TransitionArray* transitions is safe.

Review URL: https://chromiumcodereview.appspot.com/12583013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00