v8: backport fix for CVE-2013-6639 and CVE-2013-6640 (v0.10)

Quoting CVE-2013-6639:

    The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before
    3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote
    attackers to cause a denial of service (out-of-bounds write) or possibly
    have unspecified other impact via JavaScript code that sets the value of an
    array element with a crafted index.

Quoting CVE-2013-6640:

    The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before
    3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote
    attackers to cause a denial of service (out-of-bounds read) via JavaScript
    code that sets a variable to the value of an array element with a crafted
    index.

Like 6b92a7, this is unlikely to affect node.js because it only runs local,
trusted code.  However, if there exists some module somewhere that populates
an array index with remotely provided data this could very well be used to crash
a remote server running node.  Defense in depth and all.

This is a backport of upstream commit r17801. Original commit log:

    Limit size of dehoistable array indices

    LOG=Y
    BUG=chromium:319835,chromium:319860
    R=dslomov@chromium.org

    Review URL: https://codereview.chromium.org/74113002