Merged r19834, r19843 into 3.24 branch.

Fix lazy deopt after tagged binary ops

BUG=chromium:350434
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/201153020

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
PPC: Merged r19834, r19843 into 3.24 branch.
Merged r20022 into 3.24 branch.

Apply numeric casts correctly in typed arrays and related code.

BUG=353004
LOG=N
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/209393014

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r20033, r20138 into 3.24 branch.

Fix TransitionElementsKindStub to handle non-JSArray objects correctly.

Fix missing access check in Runtime_SetPrototype.

BUG=352982,chromium:354123
R=ulan@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/212623002

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Conflicts:

	test/cctest/test-api.cc
PPC: Merged r20033, r20138 into 3.24 branch.
Merged r20262 into 3.24 branch.

Always initialize elements pointer in fast literals.

R=jochen@chromium.org
BUG=355586

Review URL: https://codereview.chromium.org/218753004

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merged r19923 into 3.24 branch.

Propagate updated offsets in BoundsCheckBbData.

BUG=350863,chromium:352929
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/218393015

git-svn-id: https://v8.googlecode.com/svn/branches/3.24@20378 ce2b1a6d-e550-0410-aec6-3dcde31c8c00