[turbofan] Fix unsafe out-of-bounds check for checked loads/stores.

BUG=chromium:443744
LOG=y
TEST=mjsunit/compiler/regress-443744
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/804993004

Cr-Commit-Position: refs/heads/master@{#25901}
Use weak cell in LoadGlobal handler.

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/816923004

Cr-Commit-Position: refs/heads/master@{#25902}
Follow-on to hydrogen fix keyed loads with string keys for vector ics.

r25817 optimized hydrogen keyed loads with string keys.
(https://codereview.chromium.org/755513003).
This CL adapts that work for the vector-ic keyed load.

BUG=

Review URL: https://codereview.chromium.org/820673002

Cr-Commit-Position: refs/heads/master@{#25903}
[turbofan] false is also falsish.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/814833006

Cr-Commit-Position: refs/heads/master@{#25904}
Use weak cell to embed map in CompareNil IC.

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/812353002

Cr-Commit-Position: refs/heads/master@{#25905}
MIPS64: Use weak cell in LoadGlobal handler.

Port bc0d2e237b1b624bed26ba849529b40329ea72a2

BUG=v8:3629
LOG=N
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/814193004

Cr-Commit-Position: refs/heads/master@{#25906}
Vector-based ICs also need to hold maps weakly.

Regular ICs in MONOMORPHIC and POLYMORPHIC state now hold onto maps with
WeakCells. Vector-based ICs should do the same.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/815953002

Cr-Commit-Position: refs/heads/master@{#25907}
Use SetOwnElement when creating splice records in array length setter

This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Review URL: https://codereview.chromium.org/820503005

Cr-Commit-Position: refs/heads/master@{#25908}