Fix crash involving zombie maps escaping from the JSON parser's underground lab

Zapping is required since transition arrays contain weak references to maps: At the end of a GC cycle, ClearNonLiveTransitions removes references to dead maps from transition arrays. If a marked transition array with weak (dead) references is replaced by another transition array before the end of the GC cycle, dead references are not removed from the replaced transition array. If the replaced transition array is kept alive by a handle, marking will crash when trying to mark the first reference to a dead map.

Review URL: https://codereview.chromium.org/12987013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix store_mode bug involving polymorphism with external and JS arrays.

Review URL: https://codereview.chromium.org/12987014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Generalizing remaining Allocate functions in the macro assemblers used in pretenuring.

BUG=

Review URL: https://codereview.chromium.org/12440041

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add AssertNoAllocation to ensure TransitionArray* transitions is safe.

Review URL: https://chromiumcodereview.appspot.com/12583013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Create a new HandleScope for each JSON-parsed object to avoid excessive growth

Review URL: https://chromiumcodereview.appspot.com/12880019

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Change LookupForWrite to always do a full lookup and check the result.

Port r14061 (df49702a)

Original commit message:
If we find a property in the prototype-chain that we can overwrite, and
we have a transition, keep the holder in the lookup-result as the actual
holder. We will need it for the consistency-check in GenerateStoreField.

By directly checking the entire chain we avoid having to lazily bail out
to a copy of the miss stub while generating the Field Store IC.

Currently this CL disallows a normal non-receiver holder, given that
that would require a positive lookup + details verification to ensure
the property did not become read-only. This fixes the regressions in the
attached tests.

BUG=

Review URL: https://codereview.chromium.org/12924011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Use code_range()->exists() to determine the size of the first code page when code range is used.

Review URL: https://codereview.chromium.org/12452012
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove bogus test flags

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/12872007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00