Port r14842 (1c8d7430)

BUG=

Review URL: https://codereview.chromium.org/15917012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:244461
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/15766005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/16096003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14857 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

They caused test failures and performance regressions.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/16158002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/16092004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=chromium:243868
TEST=mjsunit/regress/regress-crbug-243868

Review URL: https://codereview.chromium.org/16155003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/14899005

Patch from Jochen Eisinger <jochen@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15988005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14852 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r14846.

Broke Mozilla test (see http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/3608/steps/Mozilla/logs/stdio), e.g.:

=== mozilla/js1_5/Array/regress-451483 ===
--- stdout ---
BUGNUMBER: 451483
STATUS: [].splice.call(0) == []
/mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/data/js1_5/Array/regress-451483.js:57: illegal access
  var result = [].splice.call(0);
                         ^
Command: /mnt/data/b/build/slave/v8-linux-shared/build/v8/out/Release/d8 --test --nobreak-on-abort --nodead-code-elimination --nofold-constants --expose-gc /mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/mozilla-shell-emulation.js /mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/data/shell.js /mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/data/js1_5/shell.js /mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/data/js1_5/Array/shell.js /mnt/data/b/build/slave/v8-linux-shared/build/v8/test/mozilla/data/js1_5/Array/regress-451483.js

TBR=rafaelw@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16150003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15664005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15964004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://codereview.chromium.org/15898004

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=adamk,rossberg
BUG=

Review URL: https://codereview.chromium.org/15837006

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg,adamk,arv
BUG=

Review URL: https://codereview.chromium.org/15331002

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/15700007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15837007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/16099004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16134003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The test should be stable now.

Drive-by: removed test-heap-profiler/HeapSnapshotsDiff from cctest.status as there is no such test

BUG=None
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/15786005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16010004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Now that the only known client console.profiles was removed from Blink:
https://src.chromium.org/viewvc/blink?revision=151136&view=revision
https://src.chromium.org/viewvc/blink?revision=151196&view=revision
this method can be deprecated and all the code that supports filtering
CPU profiles based on security origins can be later removed.

Drive-by fix: in line with CpuProfiler changes deprecated HeapProfiler::FindHeapSnapshot to reduce v8 API surface. FindHeapSnapshot may well be implemented based on existing GetSnapshotCount/GetSnapshot and it is only used in the tests.

BUG=None
R=jkummerow@chromium.org, loislo@chromium.org

Review URL: https://codereview.chromium.org/16114002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16126002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14829 (8fba0f34)

Original commit message:
Fix the hole loading optimization.
- Holes are only ever loaded as double or tagged.
- Change to tagged has to deoptimize on undefined (no implicit   conversions from double the hole NaN -> tagged undefined).

BUG=

Review URL: https://codereview.chromium.org/16116002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14814 (8a28ccfb)

BUG=

Review URL: https://codereview.chromium.org/16041005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

- Holes are only ever loaded as double or tagged.
- Change to tagged has to deoptimize on undefined (no implicit
  conversions from double the hole NaN -> tagged undefined).

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16099006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=mjsunit/debug-evaluate-locals-optimized-double

BUG=

Review URL: https://codereview.chromium.org/14631016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14819 (1ee1db14)

BUG=

Review URL: https://codereview.chromium.org/16099003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

E.g., v8-i18n wants to set the return value with a different type of a Persistent.

BUG=NONE
R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/16102002

Patch from Marja Hölttä <marja@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Notes:

- For now, just adds the missing type info fields to the AST nodes directly.
  I'd like to factor that out more nicely in a follow-up CL.

- All type feedback now is uniformly collected through AST nodes'
  RecordTypeFeedback functions. At some point, this logic should be moved
  out of ast.cc.

- The typing pass currently simulates the exact same conditions under
  which feedback was collected in Hydrogen before. That also should be
  made more generic in the future.

- Type information itself is unchanged. Making it more regular is
  yet more future work.

Some additional cleanups:

- Lifted out nested class ObjectLiteral::Property, to enable forward declaration.
- Moved around some auxiliary enums.

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14990014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14825 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/16095004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14816 (0485153d)

BUG=

Review URL: https://codereview.chromium.org/16035008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/15838010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16021010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The bug in the existing code was that it modified the |attributes|
local variable on its way through the loop in CopyUpToAddAttributes.
But that affected any properties updated after an accessor property.
The code now sets up a mask each time and applies that instead of
mutating |attributes|.

R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16051002

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When the regexp pattern parser encounters an unbound reference to a
capturing group, it needs to scan ahead to decide whether it really
is a reference.  The scan advances to the end of the pattern string
and sets has_more_ to false, but fails to reset it to true so that
later on, parsing a character class wrongly fails.

R=ulan@chromium.org
BUG=v8:2690

Review URL: https://chromiumcodereview.appspot.com/15712006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15841007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15881004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15861009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This commit fixes the register usage of DIRECT_API_CALL_NEW
and DIRECT_GETTER_CALL_NEW:

* These functions expect arguments in a0-a1 and not in a1-a2
  as the and DIRECT_API_CALL and DIRECT_GETTER_CALL do.
* Fixes the simulator to expect *_NEW arguments in a0-a1.
* Adds more comment to simulator to better explain the
  register usage.

TEST=cctest/test-api/LoadICFastApi_DirectCall_GCMoveStub,cctest/test-api/SimpleCallback

BUG=

Review URL: https://codereview.chromium.org/15813005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14807 (c26f44d6)

BUG=

Review URL: https://codereview.chromium.org/15821007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00