Merged r19862 into 3.24 branch.

Use intrinsics for builtin ArrayBuffer property accesses

BUG=chromium:351787
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/198023002

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@19863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r19798, r19896 into 3.24 branch.

Fix bug in constant folding object comparisons.

Correctly retain argument value when deopting from Math.round on x64.

BUG=351624
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/199093003

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@19970 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r19693, r19694, r19847, r19893 into 3.24 branch.

Fix HConstants with Smi-ranged HeapNumber values

Fix for failing asserts in HBoundsCheck code generation on x64: use proper cmp operation width instead of asserting that Integer32 values should be zero extended. Similar to chromium:345820.

KeyedStoreIC miss didn't handle a transitioning case.

BUG=chromium:349878,349465,350884
LOG=N
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/201763002

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@19979 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r19834, r19843 into 3.24 branch.

Fix lazy deopt after tagged binary ops

BUG=chromium:350434
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/201153020

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/3.24' into 3.24