Merged r13853 into 3.17 branch.

Insert missing type cast in JSON.stringify.

BUG=v8:2570
R=danno@chromium.org

Review URL: https://codereview.chromium.org/14840007

git-svn-id: https://v8.googlecode.com/svn/branches/3.17@14514 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r13828, r13847 into 3.17 branch.

Properly handle misses for StoreArrayLengthStub on ia32 and x64

Fix Array.length, String.length and Function.prototype LoadICs on x64.

BUG=v8:2566,v8:2568
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14649015

git-svn-id: https://v8.googlecode.com/svn/branches/3.17@14552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r14481 into 3.17 branch.

Fix beyond-heap load on x64 Crankshafted StringCharFromCode

BUG=chromium:235311
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/14959008

git-svn-id: https://v8.googlecode.com/svn/branches/3.17@14556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r14638 into 3.17 branch.

Fix missing hole check for loads from Smi arrays when all uses are changes

BUG=chromium:233737
R=danno@chromium.org

Review URL: https://codereview.chromium.org/14698021

git-svn-id: https://v8.googlecode.com/svn/branches/3.17@14687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r14732, r14734 into 3.17 branch.

Zap map value in the stub-cache on clear. The empty_string is a valid key for keyed loads and stores.

Add regression test for fix from r14732.

R=jkummerow@chromium.org
BUG=chromium:242502

Review URL: https://codereview.chromium.org/16084007

git-svn-id: https://v8.googlecode.com/svn/branches/3.17@14840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00