Bugfix for 349874: we incorrectly believe we saw a growing store

Bugfix for 349874: we incorrectly believe we saw a growing store

When we set an out of bounds array index, the index might be so large that
it causes the array to go to dictionary mode. It's better to avoid
"learning" that this was a growing store in that case.

This fix also partially reverts a fix for bug 347543, as this fix is
comprehensive and satisfies that repro case as well (partial revert of
v19591).

BUG=349874
LOG=N
R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=19691

[mvstanton, 2014-03-06 12:59:32]

Hi Toon,
Here is what we discussed, PTAL,
--Michael

[Toon Verwaest, 2014-03-06 13:03:06]

lgtm

[mvstanton, 2014-03-06 13:08:00]

Committed patchset #1 manually as r19691 (tree was closed).