Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow

Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow
(https://code.google.com/p/v8/issues/detail?id=2795)

The reason is when allocating and building arrays in hydrogen we need to ensure
we do any int32-to-smi conversions BEFORE the allocation. These conversions can
at least theoretically deoptimize. If this happens before all the fields of the
newly allocated object are filled in, we will have a corrupted heap.

BUG=
R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=15929

[mvstanton, 2013-07-26 12:32:57]

Hi Toon, here is the issue we worked on, thanks!
--Michael

[Toon Verwaest, 2013-07-26 13:39:13]

Can you add a regression test for the MaxGrow check, that overflows the smi
range?

[mvstanton, 2013-07-29 07:30:38]

Done, thanks!

[Toon Verwaest, 2013-07-29 11:49:05]

lgtm

[mvstanton, 2013-07-29 11:50:45]

Committed patchset #4 manually as r15929 (presubmit successful).