[Object.observe] Lazily allocate callbackInfo structure

This patch allows callbacks to lazily allocate the InternalArray which is used to store pendingChangeRecords. This moves some of the expense of observation to the case where changes actually occurred.

When there are no pendingChangeRecords, the callbackInfo structure is a number which is the callbacks priority. Whenever a changeRecord is enqueued to the callback, it "normalizes" to be an InternalArray with a priority property. Immediately before its changeRecords are delivered, it returns to its optimized state.

---
Note: Naming confusion resolved:

This patch corrects some naming confusion in object-observe.js. Previously, we used the terms "callback" and "observer" to mean roughly the same thing, and overloaded the term "observer" to be both the callback itself and the *registration* on a object to observe (which now includes an accept map).

This patch resolves this confusion:

"object" (objectInfo, objectInfoMap): This refers to the observed object and its structures

"callback" (callbackInfo, callbackInfoMap): This refers to the callback to whom change records may be delivered

"observer" (objectInfo.changeObservers): This refers to a registration to observe a given object by a given callback with the specified accept list.
---

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/19132002

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Use BitVector instead of handcrafted SparseSet.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/19272011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Throw if first argument to TypedArray.set is a number.

Further refinement to semantics that I have missed in previous change.
Both Blink and Firefox are permissive with arguments to .set method.
However, when first argument to "set" is a number, all implementations
throw, so that users know that
   a.set(0,27)
does not assign 27 to 0th element of a, not 0 to 27th element of a.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19210002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Minor cleanup of GVN state pushing.

R=hpayer@chromium.org, hpayer@google.com

Review URL: https://codereview.chromium.org/19235010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Added tracing information to the case when allocation folding cannot be performed.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19290008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix cctest/test-cpu-profiler/FunctionApplySample fakiness on ARM simulator

For STM and LDM instuctions with writeback update base register only after all registers have been saved/loaded. This guarantees that invariant sp <= fp is always true when iterating stack in the Sampler.

BUG=v8:2782
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Extend expectations for slow test cases on the V8/blink trunk builder.

The second test has an existing expectation that is extended.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19299004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Added mark bit cell iterator.

BUG=
R=mstarzinger@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/19182002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make TransitionArray internal references originate from TA in heap snapshot.

TransitionArray references were added to the TA's map object instead
of TA itself.

R=verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19265002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Try to remove invalidated stubs before falling back to checking the constant state.

BUG=chromium:260585
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19267019

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@15693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00