Merged r19545, r19668, r19670 into 3.24 branch.

Mark HCompareMap as having Tagged representation

x64: Fix LMathMinMax for constant Smi right-hand operands

Handle exception when retrieving toJSON function in JSON.stringify.

BUG=chromium:346636,chromium:349079,349335
LOG=N
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/183023008

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@19671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/3.24' into 3.24