MIPS: Fix NaN handling for start index in ArraySplice.

Casting NaN to int is unpredictable, on different architectures it produces different int value.

TEST=test262/S15.4.4.10_A2.1_T2, S15.4.4.10_A2.2_T2, S15.4.4.12_A2.1_T2

BUG=

Review URL: https://codereview.chromium.org/14257006
Patch from Dusan Milosavljevic <Dusan.Milosavljevic@rt-rk.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Add monomorphic CompareNilICs and Crankshaft support

Port r14407 (cae6596b)

BUG=

Review URL: https://codereview.chromium.org/13840006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Generators can resume

Port r14415 (d358defa) and r14424 (7b549ce7)

Original commit message:
The generator object methods "next", "send", and "throw" now
include some inline assembly to set up a resumed stack frame.  In some
common cases, we can just jump back into the frame to resume it.
Otherwise the resume code calls out to a runtime to fill in the operand
stack, rewind the handlers, and possibly to throw an exception.

BUG=v8:2355
TESTS=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/13864010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Clean up VMState a little bit.

Port r14421 (31cd7dda)

BUG=

Review URL: https://codereview.chromium.org/14483002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14429 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix overflow check in mul-i which was missing since r14322

Review URL: https://codereview.chromium.org/14471012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14430 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Grow the old generation faster in high promotion mode.

BUG=

Review URL: https://codereview.chromium.org/14493011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix evaluation order problems in Object.observe hooks.

R=rossberg@chromium.org
TEST=gcmole

Review URL: https://codereview.chromium.org/14493012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Get isolate from thread local instead of (potentially missing) block in HConstant.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/14284011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14433 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Capture receiver in generator object

Previously there has been no reason to context-allocate the receiver, so
access to the receiver always goes through the stack.  This was failing
with generators, which assumed that forcing context allocation would
relieve the need of storing anything but the context and the function on
the stack.

This CL adds a slot in generator objects to capture the receiver, and
restores it when resuming a generator.

BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14158006

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Relax --debug-code checks that runtime returns are not the hole

ia32, unlike the other architectures, includes a --debug-code check that
asserts that runtime functions do not return the hole.  However the new
SuspendJSGeneratorObject runtime does return the hole at times.

This CL adds a wee hack that only signals an error if the callee was not
SuspendJSGeneratorObject.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13856011

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14437 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
First cut at API for ES6 ArrayBuffers

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13958007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14438 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Tell the GC prologues to construct RetainedObjectInfos only when needed.

The GC prologue is called by the GC, but also by the heap snapshotter. The
RetainedObjectInfos are only needed by the heap snapshotter, so it's wasteful to
construct them always. (And it will be even more wasteful when Blink migrates to
the new GC APIs, since after that point it no longer knows about object groups.)

BUG=

Review URL: https://codereview.chromium.org/14471028
Patch from Marja Hölttä <marja@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Win64 build

R=rossberg@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/14392013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Constructed arrays can be created with Hydrogen code stubs. The feature is still off by default (--optimize-constructed-arrays).

BUG=

Review URL: https://codereview.chromium.org/12385014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00