This speeds up both the case from the bug (using Object.create) but also
takes care ofthe "{ __proto__: obj  }" syntax, which was previously (and
erroneously) being treated the same as setting the prototype dynamically
from script using the __proto__ setter or Object.setPrototypeOf.

BUG=chromium:422754
LOG=y
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/667253002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

setter-on-elements had the wrong length hardcoded in a for loop over the
creation functions (getter-on-elements had the right length, but seemed
worth future-proofing).

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/643143005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Terminate is need for non-terminating loops (NTLs) that can appear after optimizing control flow. It gathers the control and effect(s) from a NTL and connects them to end so that they are not dead-code removed.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/651843004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

 In R23940 (https://code.google.com/p/v8/source/detail?r=23940) it introduces
 Isolate::CreateParams and mentions that V8::SetJitCodeEventHandler should either
 be passed to Isolate::New as well, or invoked via the Isolate.

 When Chrome as embedder of V8, we will set the Jit Code event handler for Vtune
 support during the initialization of renderer process and V8 has be initialized
 at that time. It's better that we invoke V8::SetJitCodeEventHander via the Isolate.
 So we change the vTune::InitializeVtuneForV8(v8::Isolate::CreateParams& params) to
 vTune::InitializeVtuneForV8(v8::Isolate* isolate).

 we will do corresponding changes in chromium code if this patch is landed and Chromium
 updates V8 to the
 new release branch.

 some part of this patch is provided by denis.pravdin@intel.com.

BUG=
R=danno@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/655183002

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/666353002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This CL broadens the checks done by the verifier in untyped mode and introduces some subroutines to shorten the code a bit.

Introduce routines CheckUpperIs() CheckUpperMaybe() and CheckValueInputIs() that are called unconditionally by the verifier. If the typing mode is untyped, then don't check anything.

Also added a couple checks for Merge and Loop nodes that catch bugs where the operator and the node disagree on input counts (a bug encountered today).

R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/669073002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

harmony-tostring needs to emulate InstallFunctions --- InstallFunctions will fail
in Debug builds because the `toString` property already exists in Object.prototype.

The fix is to add some of the other features from InstallFunctions() to the
setup of ObjectToStringHarmony.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/667263004

Patch from Caitlin Potter <caitpotter88@gmail.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:3534
LOG=
R=svenpanne@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/614733002

Patch from Diego Pino <dpino@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/667373004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24806 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Currently a no-op and added only for consistency with ASan/TSan.

BUG=chromium:425187
R=machenbach@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/667903004

Patch from Sergey Matveev <earthdok@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24805 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/638883006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24804 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/672583002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Branch can now have an optional hint, when the condition is
likely true or false, and if such a hint is present the other
basic block will be marked as deferred and placed at the end
of the function.

We currently use this feature for tagging int32/uint32 in
change lowering, and for load/store bounds checks in simplified
lowering.

TEST=cctest,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/642883003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24802 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/670463005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Macro Assember, assembler and simulator for ARM64 were missing FRINTP.

R=rodolph.perfetta@arm.com, ulan@chromium.org

Review URL: https://codereview.chromium.org/669923002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r24793 (c0c2b0d)

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=mstarzinger@chromium.org

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/641553003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org
BUG=chromium:425551
LOG=N

Review URL: https://codereview.chromium.org/654763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org
TBR=bmeurer@chromium.org
LOG=n
BUG=none

Review URL: https://codereview.chromium.org/652903008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For now it's only enabled on Linux/Intel.

R=mstarzinger@chromium.org
BUG=v8:3638
LOG=y

Review URL: https://codereview.chromium.org/650013006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/670623005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=ulan@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/673593002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When this flag is set, we will commit additional pages up until the
target size before doing a scavenge.

I made sure that all tests pass when a target size of 16MB is set.

BUG=v8:3626
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/652543007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes the problem of not being able to detect ARM features on
ChromeOS because sandbox cannot access /proc/self/auxv and
/proc/cpuinfo there.

Drive-by-cleanup to libc detection in two other places.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/672543002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/665373003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/672483002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/646873005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/665313003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24785 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:423633
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/649063003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Updates Object.prototype.toString() to use algorithm described in harmony drafts.

Currently, the behaviour is essentially the same as ES262's version, however this changes when internal structures
such as Promise make use of symbolToStringTag (as they are supposed to, see v8:3241), and changes further once
Symbol.toStringTag is exposed publicly.

BUG=v8:3241, v8:3502
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/546803003

Patch from Caitlin Potter <caitpotter88@gmail.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/654583004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/669683002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/667953002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org, bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/663333003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24779 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/671703003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/640203004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

(I'm puzzled why GCC did not report this error.)

TBR=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/669733007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

version of the keyed load stub (https://code.google.com/p/v8/source/detail?r=24661),
I allowed polymorphism between string and non-string types in the IC. Before, the
IC would go generic.

Then, at crankshaft time, we special case when we only saw strings. The error
here is that crankshaft can't emit code that handles polymorphism between string
and non-string types. The choice is either to get that to happen (I don't deem
this necessary from a performance point of view, an IC with such type feedback
before would have gone generic), or simply check for the case of "polymorphic
with some string maps" and require crankshaft to go generic. I'll do the latter.

BUG=425519
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/667923004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org
BUG=421634
LOG=N

Review URL: https://codereview.chromium.org/667703002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00