Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow
(https://code.google.com/p/v8/issues/detail?id=2795)

The reason is when allocating and building arrays in hydrogen we need to ensure
we do any int32-to-smi conversions BEFORE the allocation. These conversions can
at least theoretically deoptimize. If this happens before all the fields of the
newly allocated object are filled in, we will have a corrupted heap.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/20726002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make it easier to get JS stack crawls from gdb

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/21060002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix HasResult method of LTemplateInstruction to properly handle LCheckSmi

LCheckSmi sometimes has a result register and sometimes not, even though its
LTemplateInstruction alwasys has room for one. Debug output use HasResult to
determine whether it was ok to de-ref result(), but HasResult doesn't check for
the case where LTemplateInstruction has a result but it's NULL.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/21037004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00