MIPS: Make HCheckPrototypeMaps compatible with parallel recompilation.

Port r13454 (2c0dd0ff)

Original commit message:
HCheckPrototypeMaps currently records the prototype and the holder of the
prototype chain (both ends of the chain) and assumes that the chain elements
and their maps did not change in during the entirety of Crankshaft. The actual
traversal of the prototype chain happens in Lithium at code generation.
With parallel compilation, this assumption is not longer correct.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/12036030
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Avoid handle dereference during graph optimization.

Port r13475 (0076e1ee)

Original commit message:
With parallel recompilation enabled, objects made accessible by handles may
have changed between graph construction and graph optimization. Therefore
we must not assume that information on those objects remain the same between
those two phases. To police this, we forbid handle dereferencing during
graph optimization.
Exceptions to this rule are:
 - Dereferencing the handle to obtain the raw location of the object. This
   is safe since parallel recompilation acquires RelocationLock
 - Some places that dereference the handle for a type check. These are checked
   to be safe on a case-by-case basis.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/12049037
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Move polymorphic stub computation and compilation to stub cache

Review URL: https://chromiumcodereview.appspot.com/11953025

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.

After r13289 the divisor can be non-constant, so we should check for zero.

BUG=171641
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047050

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Always fail when trying to store to an undeclared global variable, even if it was found.

Finding a property, but not using an IC, indicates that the variable was
found on the prototype (in DOMWindow). Those properties need to be
ignored while storing global properties via the IC.

Review URL: https://chromiumcodereview.appspot.com/12040039

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix corner case when JSFunction is evicted from flusher.

This fixes a corner case that happens when JSFunctions are enqueued as
code flushing candidates but their respective SharedFunctionInfo isn't.
If the JSFunction gets evicted due to optimization the code slot in the
SharedFunctionInfo will never be recorded in the slots buffer.

R=hpayer@chromium.org
BUG=chromium:168801
TEST=cctest/test-heap/Regress168801

Review URL: https://codereview.chromium.org/11896064

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
ARM: Make use of d16-d31 when available.

Review URL: https://chromiumcodereview.appspot.com/11428137
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Ensure a type-error is thrown when trying to assign to a readonly property on the global scope.

Review URL: https://chromiumcodereview.appspot.com/11953056

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implicit references are missing in heap profiles
Review URL: https://codereview.chromium.org/11953043

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix --hydrogen-stats.

V8 crashes with this flag when trying to compile hydrogen stubs.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12045048

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Allow removal of obsolete map checks after transitions.

This allows side effect dominator tracking to remove map checks that are
dominated by a single HStoreNamedField that performs a transition on the
same object. A similar trick could be applied to HAllocateObject.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12035026

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Force inlining of object visiting functions.

BUG=

Review URL: https://codereview.chromium.org/12049033

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make embedded maps in optimized code weak.

Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix map check removal issue in r13488.

The removal of HCheckMaps is invalid when the instruction has a virtual
usage, which can happen e.g. for HLoadElements or HJSArrayLength.

R=jkummerow@chromium.org
TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html

Review URL: https://codereview.chromium.org/12033073

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge UpdateLoadCaches into a single function dispatching on
ComputeLoadMonorphic and UpdateMegamorphicCache.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix bug in edge case in populating PointerMaps

If a live range was split immediately before an instruction that required a
safe-point pointer map, it was possible for the safe-point to incorrectly use the
register/stack slot information of the preceeding live range rather than the one
that actually covers the safe-point.

R=mstarzinger@chromium.org,vegorov@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12040052

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Use MemoryChunk-based allocation for deoptimization entry code

This is done by first committing the deoptimization entry code with a minimal
area size (OS::CommitPageSize) and later using CommitArea to adjust the size.

Review URL: https://codereview.chromium.org/11566011
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert r13494: "Use MemoryChunk-based allocation for deoptimization entry code"

This patch seems to cause crashes on Windows.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12049069

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement VisitHandlesInNewSpaceWithClassIds()

BUG=
TEST=test-api.cc::PersistentHandleInNewSpaceVisitor

Review URL: https://codereview.chromium.org/11365131
Patch from Kentaro Hara <haraken@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Prepare push to trunk.  Now working on version 3.16.10.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12047084

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@13497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00