Merge v8 from https://chromium.googlesource.com/v8/v8.git at 5830436a84f7792f61451af9bccd991d923fe81c

This commit was generated by merge_from_chromium.py.

Change-Id: I51b6008d53fd18cb707bcdb63d33a44eb922f321
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index 63c3799..1f3c750 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -1807,12 +1807,12 @@
         StoreIC::Store(object, Handle<String>::cast(key), value,
                        JSReceiver::MAY_BE_STORE_FROM_KEYED),
         Object);
-    if (!is_target_set()) {
-      TRACE_GENERIC_IC(isolate(), "KeyedStoreIC",
-                       "unhandled internalized string key");
-      TRACE_IC("StoreIC", key);
-      set_target(*stub);
-    }
+    // TODO(jkummerow): Ideally we'd wrap this in "if (!is_target_set())",
+    // but doing so causes Hydrogen crashes. Needs investigation.
+    TRACE_GENERIC_IC(isolate(), "KeyedStoreIC",
+                     "unhandled internalized string key");
+    TRACE_IC("StoreIC", key);
+    set_target(*stub);
     return store_handle;
   }
 
diff --git a/src/version.cc b/src/version.cc
index e7e931b..d95007d 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     29
 #define BUILD_NUMBER      88
-#define PATCH_LEVEL       0
+#define PATCH_LEVEL       1
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0