1) Since we fill the output buffer both from the chunks and the conversion
buffer, it's possible that we run out of space and call CopyCharsHelper with 0
length. The underlying functions don't handle it gracefully, so check there.

2) There was a bug where we used to try to copy too many characters from the
beginning of the data chunk into the conversion buffer. Continuation bytes in
UTF-8 are of the form 0b10XXXXXX. If a byte is bigger than that, it's the first
byte of a new UTF-8 character and we should ignore it.

These two together (or maybe in combination with surrogates) are a probable
reason for crbug.com/420932.

3) The test data was off; \uc481 is \xec\x92\x81.

BUG=420932
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/662003003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/642293005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24724 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/656533003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For a longer discussion, see the associated Chromium issue.

BUG=chromium:423311
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/662513004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/646983005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This issue is for discussion on how to proceed.

I think the implementation of ValueOf shows that directly creating the IR does not scale.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/612043003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/660843003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24718 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org, jarin@chromium.org

BUG=

Review URL: https://codereview.chromium.org/664683002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=unittests,mjsunit/asm/int32array-constant-key
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/647773004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r24676 to see if it was the cause for the mysterious
crashes on some bots. If not, we'll reland it.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/663013002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

port r24704.

original commit message:

  ReceiverCheckMode needs to be utilized further.

  The parameter wasn't being passed appropriately, and there was an extra
   opportunity to use mode RECEIVER_IS_STRING in SubStringStub.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/664973002

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

port r24700.

original commit message:

  Tick processor: Print C++ entry points

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/662323002

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/664003003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

original commit message:

  Implement the new semantics for 'super(...)'

  Per the latest ES6 draft, super(...) translates into a call
   to function's prototype.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/642603006

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

port r24672.

original commit message:

  Move them from .data to .rodata.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/654263006

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/664613004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r24704 (f43a27ee)

Original commit message:
The parameter wasn't being passed appropriately, and there was an extra
opportunity to use mode RECEIVER_IS_STRING in SubStringStub.

BUG=
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/645823003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Some versions of Outlook Web Access test for the existence of a 'values'
property on Array instances, so adding the 'values' iterator to the prototype
(even with @@unscopeables) causes breakage.

This matches Gecko: they ship Array.prototype.{keys,entries} but not 'values'.

BUG=409858
LOG=Y
R=arv@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/647703003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, ishell@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24691

Review URL: https://codereview.chromium.org/652303002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The parameter wasn't being passed appropriately, and there was an extra
opportunity to use mode RECEIVER_IS_STRING in SubStringStub.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/657313005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/661123002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=loislo@chromium.org, yangguo@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/638633002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/659313003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=mstarzinger@chromium.org

BUG=

Review URL: https://codereview.chromium.org/659333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=chromium:419663
LOG=Y

Review URL: https://codereview.chromium.org/658723005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, arv@chromium.org, ishell@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/649603003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r24691 because win64 release build breaks.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/659313002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Trimming the graph consists of breaking links from nodes that are not reachable from end to nodes that are reachable from end. Such dead nodes show up in the use lists of the live nodes and though mostly harmless, just clutter up the graph. They also can limit instruction selection opportunities, so it is good to get rid of them.

This CL is one half of the ControlReducer functionality, the other half
being branch folding.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/661923002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/653093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/652303002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r24683 (b1533f6)

Original commit message:
Per the latest ES6 draft, super(...) translates into a call
to function's prototype.

BUG=v8:3330
LOG=N
R=dusan.milosavljevic@imgtec.com

Review URL: https://codereview.chromium.org/661043003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/664693002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jochen@chromium.org
BUG=v8:3628
LOG=N

Review URL: https://codereview.chromium.org/663483003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Adapted from patch contributed by Isiah Meadows <impinball@gmail.com>.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/657863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jochen@chromium.org
BUG=v8:3628
LOG=N

Review URL: https://codereview.chromium.org/650423005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=mjsunit,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/638853004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=arv@chromium.org, machenbach@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/645933003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Per the latest ES6 draft, super(...) translates into a call
to function's prototype.

R=arv@chromium.org, ishell@chromium.org, verwaest@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/661433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also small reformat in Iterators/forof.js

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/662723006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/641343005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00