Array.prototype.sort: Unchecked calls to hasOwnProperty and push and sort

BUG=v8:3537
LOG=
R=arv@chromium.org, wingo@igalia.com, yangguo@chromium.org

Review URL: https://codereview.chromium.org/555173002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is a reland of issue 563813002:

https://codereview.chromium.org/575473002/

This time with additional include headers and MSVC specific guards. Previously, only V8 Win32 - nosnap - shared failed:

http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/2916

R=marja@chromium.org

Review URL: https://codereview.chromium.org/576733002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix the IsTheHole bug.

For Double constant of non nan, object_ may be uninitialized.

(This patch comes from weiliang.lin@intel.com )

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/565183004

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/bleeding_edge' into bleeding_edge