MIPS: Fixed illegal instruction use on Loongson in code for Math.random().

BUG=v8:2115
TEST=mjsunit/string-case,mjsunit/regress/regress-110509,mjsunit/math-floor

Review URL: https://chromiumcodereview.appspot.com/10383044
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make DeltaBlue performance more stable by ignoring type feedback that
tells us that a map can transition to another map when we are generating
code for load operations.  This may cause us to deopt if the same routine
is seeing different maps caused by branching in constructors.  If so, I
have a different change that is around 100 times more complicated that
lets us generated Crankshaft code for negative lookups.
Review URL: https://chromiumcodereview.appspot.com/10306010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Regexp: Fix overflow in min-match-length calculation.  Crbug=126412.
Review URL: https://chromiumcodereview.appspot.com/10384053

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix function sorter from 11482 with correct fix.  The sorter
was reverted from trunk 3.10.8.1, with this change we can
repush it.
Review URL: https://chromiumcodereview.appspot.com/10377043

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Force inlining CopyChars and String::Get.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10332054

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement explicit back pointers in transition tree.

This makes back pointers in the map transition tree explicit by having
accurate back pointers throughout the lifetime of maps instead of
establishing and destroying back pointers before and after each marking
phase. This is a prerequisite for being able to clear map transitions
during incremental marking.

R=vegorov@chromium.org
BUG=v8:1465

Review URL: https://chromiumcodereview.appspot.com/10381053

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make Error.prototype.name writable again, as required by the spec and the web.

Address http://code.google.com/p/chromium/issues/detail?id=69187 by instead
ignoring getters on ReferenceError.prototype.name in Error.prototype.toString.

And while we're at it, do the same for SyntaxError and TypeError, and the
properties "message", "type", and "arguments" on all of them, which
potentially have similar issues.

R=danno@chromium.org
BUG=69187
TEST=

Review URL: https://chromiumcodereview.appspot.com/10234004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Force checking of result on all functions in elements.h that return MaybeObject*.

Add two missing failure checks found by this.
Review URL: https://chromiumcodereview.appspot.com/10356071

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Split nodes and edges into separate arrays in heap profiler.

This allowed the following changes:
  - heap profiler now makes one pass less over the heap.
  - HeapEntriesMap does not allocate EntryInfo per each entry.
  - there's no need for an extra pass to set indexes before serialization.

As a result snapshot taking time has reduced up to 2x times.

Review URL: https://chromiumcodereview.appspot.com/10353010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11531 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Declare more functions returing a MaybeObject* with MUST_USE_RESULT.

No violations found this time.

Additionally I changed one function JSDate::GetField that never returns
a failure to return a Object* instead.
Review URL: https://chromiumcodereview.appspot.com/10383088

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Properly set ElementsKind of empty FAST_DOUBLE_ELEMENTS arrays when transitioning.

R=jkummerow@chromium.org
BUG=chromium:117409
TEST=test/mjsunit/regress/regress-117409.js

Review URL: https://chromiumcodereview.appspot.com/10386045

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix formatting.

TBR=mnaganov@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10356075

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@11534 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote branch 'v8/bleeding_edge' into hj-dev-palfia