Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow
(https://code.google.com/p/v8/issues/detail?id=2795)
The reason is when allocating and building arrays in hydrogen we need to ensure
we do any int32-to-smi conversions BEFORE the allocation. These conversions can
at least theoretically deoptimize. If this happens before all the fields of the
newly allocated object are filled in, we will have a corrupted heap.
BUG=
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/
20726002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15929
ce2b1a6d-e550-0410-aec6-
3dcde31c8c00