Increase the "local variables in a function" limit.

The limit was originally added to avoid having large user-controlled constants
(variable indexes) in the code generated by full-codegen.

History behind this change:

The original CL for adding the limit was https://codereview.chromium.org/7003030
and at that time, the limit was 32767.

Reason for adding the limit (in CL comments): "The motivation behind this change
is to avoid large user controlled constants in the code. The slot_operand used
in the IA32 full code generator uses a relative load where the local index is an
(negative) immediate."

The limit was then bumped to 65535 by https://codereview.chromium.org/10965063
and to 131071 by https://codereview.chromium.org/11099063.

R=dcarney@chromium.org, svenpanne@chromium.org, jkummerow@chromium.org, rossberg@chromium.org
BUG=v8:3205
LOG=Y

Review URL: https://codereview.chromium.org/206143004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20126 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix for performance issue 353661 - 23% regression in dromaeo.

The issue was that a previous fix to avoid a logic error was not
targeted enough: it allowed non-transitioning stores to fall
into a code path meant to preserve monomorphic state in the
case of a transitioning store.

BUG=353661
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/206353002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20127 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Callers of JSArray::SetContent() handlified.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/206383003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/bleeding_edge' into bleeding_edge