Merged r18564, r19545, r19668, r19670 into 3.23 branch.

Use unsigned integer arithmetic in Zone::NewExpand.

Mark HCompareMap as having Tagged representation

x64: Fix LMathMinMax for constant Smi right-hand operands

Handle exception when retrieving toJSON function in JSON.stringify.

BUG=328202,chromium:346636,chromium:349079,349335
LOG=N
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/184983006

git-svn-id: https://v8.googlecode.com/svn/branches/3.23@19673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/3.23' into 3.23