There were some tests that are supposed to protect against js messing
with the meta data, however, they just didn't try hard enough.

BUG=354967
R=dcarney@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/215293005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r20363 (235f866c)

Original commit message:
When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219923005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r20358 (5e9b653d)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219163010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We should perform the illegal redeclaration check earlier so that we do not confuse the AST typer with missing type feedback nodes.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/218493007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218583008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, bmeurer@chromium.org
BUG=chromium:357330
LOG=Y

Review URL: https://codereview.chromium.org/219333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
TBR=jarin@chromium.org
BUG=353487
LOG=n

Review URL: https://codereview.chromium.org/219493002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218753005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

R=verwaest@chromium.org
BUG=358057
LOG=Y

Review URL: https://codereview.chromium.org/219473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=358090
TEST=test/mjsunit/regress/regress-358090.js
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/213833008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Make sure when we shrink an object that we store a filler first into the free memory before updating the map or size.

BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/219103002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dcarney@chromium.org
BUG=357137
LOG=N

Review URL: https://codereview.chromium.org/219373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20357 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/216933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20356 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/219403002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20355 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reason for revert: crashes benchmarks/sunspider/string-fasta on ia32.debug

This also reverts r20350 and r20352

> Fix LoadFieldByIndex to take mutable heap-numbers into account.
>
> BUG=
> R=ishell@chromium.org
>
> Review URL: https://codereview.chromium.org/213213002

BUG=none
LOG=n
TBR=verwaest@chromium.org

Revert "Use sarq on x64"

This reverts commit e2a8ef9321345c6bc091054443bf2b9535ff6b1c.

Revert "Don't | int and bool"

This reverts commit c90d713d3a8ceba4fec41933a63beb6e50a3d7c0.

Review URL: https://codereview.chromium.org/219393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://code.google.com/p/v8/source/detail?r=20211
>
> Review URL: https://codereview.chromium.org/206163004

R=rossberg@chromium.org
TBR=rossberg@chromium.org
LOG=y
BUG=n

Review URL: https://codereview.chromium.org/219303002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/219293002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20352 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:3247
TBR=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/217423006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/219043003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/219233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20349 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/213213002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org, yangguo@chromium.org
BUG=357105
TEST=test/mjsunit/regress/regress-357105.js
LOG=N

Review URL: https://codereview.chromium.org/216963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/219173002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/216973002

Patch from Daniel Vogelheim <vogelheim@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=none
TBR=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/219043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/169363002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20339 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=hpayer@chromium.org, yangguo@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=20330

Review URL: https://codereview.chromium.org/212603014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reason for revert: New test crashes on nosnap bots

> See https://github.com/joyent/node/issues/7120
>
> R=jarin@chromium.org
> BUG=
>
> Review URL: https://codereview.chromium.org/178073002
>
> Patch from Alexis Campailla <alexis@janeasystems.com>.

TBR=jarin@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/217013002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r20330 for breaking arm64 nosnap tests.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/216993002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20336 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

See https://github.com/joyent/node/issues/7120

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/178073002

Patch from Alexis Campailla <alexis@janeasystems.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

- GenericStringUtf16CharacterStream::start_position_ was unused.
- GenericStringUtf16CharacterStream inherits from BufferedUtf16CharacterStream,
so no need to initialize buffer_cursor_ and buffer_end_ twice (this makes it
clearer which class in the inheritance chain takes care of which variables).

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/216523004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/216873004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The Isolate* member of ParserBase::FunctionState was only used by
Parser. Removing it makes it clear that there are no isolates in
PreParser. (There's also no Zone, since PreParserTraits::Type::Zone is void.)

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/216883003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=hpayer@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/212603014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/214753002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20329 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/216643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Runtime::GetObjectProperty:
  - handled string.charAt, element access and property access
  - now handlified
GetProperty in handles.cc:
  - called to Runtime::GetObjectProperty
  - now removed
Object::GetProperty (handlified version):
  - handled element access and property access
  - now changed to only do property access
New: Object::GetPropertyOrElement:
  - handles element access and property access

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/210953005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

- Use the surrounding map (instead of Traits::Impl) for weak callback.
- Provide for a fast reference to a mapped value.
- Restructure Traits to accomondate for the first point above.

[Why?] As discussed, I proceeded to replace Impl with the map.
The problem I encountered with that version is that now the
Traits class depends on itself: The weak-related methods require the
map type in their signature. But the map type includes the Traits class
and hence the Traits class method signatures depend on the specific Traits class. That
makes them practically un-derivable: While you can derive a Traits class
from another one, since the compiler now expects methods with a different
signature. To accommodate, I pulled the dispose traits into the weak traits
class. I also removed the Impl*/MapType* parameter from the Dispose call,
since no implementation seems to need it.

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/212893007

Patch from Daniel Vogelheim <vogelheim@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:3213
LOG=Y
R=alph@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/197513005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00