Merged r14063, r14064 into trunk branch.

Fix crash involving zombie maps escaping from the JSON parser's underground lab

Fix store_mode bug involving polymorphism with external and JS arrays.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12843031

git-svn-id: https://v8.googlecode.com/svn/trunk@14067 ce2b1a6d-e550-0410-aec6-3dcde31c8c00