From ES6 25.2.3 ("Properties of the GeneratorFunction Prototype
Object"):

> The GeneratorFunction prototype object is an ordinary object. It is
> not a function object and does not have an [[ECMAScriptCode]] internal
> slot or any other of the internal slots listed in Table 27 or Table
> 56.

Introduce one assertion for the value's type and additional tests for its
properties. Remove an invalid assertion that fails as a result of this
fix.

BUG=v8:3991
LOG=N

Review URL: https://codereview.chromium.org/1062633002

Cr-Commit-Position: refs/heads/master@{#27603}

This enables for-of, as well as @@iterator implementations for strings
and arrays.

R=rossberg@chromium.org
BUG=v8:2214
LOG=Y

Review URL: https://codereview.chromium.org/446023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In doing so also remove all references to the --harmony-collections flag.
Due to the way context snapshotting works, it's not possible to simply
enable the flag by default.

Depends on ES6 Symbols: https://codereview.chromium.org/421313004

BUG=v8:1622
LOG=Y
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/427723002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* src/contexts.h:
* src/bootstrapper.cc (InitializeExperimentalGlobal): Make generator
  meta-objects, and store maps for constructing generator functions
  and their prototypes.

* src/factory.h:
* src/factory.cc (MapForNewFunction): New helper.
  (NewFunctionFromSharedFunctionInfo): Use the new helper.

* src/heap.cc (AllocateFunctionPrototype, AllocateInitialMap): For
   generators, allocate appropriate prototypes and maps.

* src/code-stubs.h:
* src/arm/code-stubs-arm.h:
* src/arm/full-codegen-arm.h:
* src/ia32/code-stubs-ia32.h:
* src/ia32/full-codegen-ia32.h:
* src/x64/code-stubs-x64.h:
* src/x64/full-codegen-x64.h: Allow fast closure creation for generators,
using the appropriate map.

* test/mjsunit/harmony/builtins.js: Add a special case for
  GeneratorFunctionPrototype.prototype.__proto__.

BUG=
TEST=mjsunit/harmony/generators-runtime

Review URL: https://codereview.chromium.org/13192004

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.

The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.

R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262

Review URL: https://codereview.chromium.org/12212011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* Turned all uses of 'const' into 'var'.
* Turned all uses of local 'function' into 'var'.
* Added a couple of missing toplevel 'var' declarations.

One consequence is that the properties on the builtin object  are no longer
non-writable, and I had to adapt one test. Is that a problem?

Unfortunately, we cannot actually switch the library scripts to strict mode
by default, because that makes observable things like poisoned .caller properties
for library functions.

Also removed dead flag code in Compiler::Compile.

R=yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9415010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The prototype of builtin functions is already unwritable, so we don't
have to make it so (the default map for functions changes after builtins
are initialized).

We no longer need to make the prototype non-extensible, since all properties
that are ever read by the bultins code has been added and frozen already.
Adding properties to the prototype, or changing its __proto__, cannot affect
code.

Removing these two pieces of initialization code reduces the snapshot size
by a few Kb.

Review URL: http://codereview.chromium.org/7839028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Prototypes and their properties and methods are locked down to prevent fiddling with their operation, even if the build-in object leaks.

Made some built-in functions only work during bootstrapping.

Review URL: http://codereview.chromium.org/7799027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9122 ce2b1a6d-e550-0410-aec6-3dcde31c8c00