Prepare push to trunk.  Now working on version 3.23.1.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/60513010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert r17152 - "Revert r17018 - "Turn on handle zapping for release builds""

Apparently, this wasn't the cause for dromaeo regressions.

> BUG=none
> R=jkummerow@chromium.org
>
> Review URL: https://codereview.chromium.org/26457002

R=verwaest@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/36843002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Object.observe] rename intrinsic change record types for consitency.

Note the spec now reflects the updated naming:

http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes

R=rossberg@chromium.org, rossberg
BUG=v8:2940

Review URL: https://codereview.chromium.org/46043020

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Improve implementation of HSeqStringSetChar.

This improves the generated code for HSeqStringSetChar across
all platforms, taking advantage of constant operands whenever
possible. It also drops the unused DefineSameAsFirst constraint
for the register allocator on x64 and ia32, where it caused
unnecessary spills when the string operand was live across the
HSeqStringSetChar instruction.

A new GVN flag StringChars is introduced to express dependencies
between HSeqStringSetChar, HStringCharCodeAt and the upcoming
HSeqStringGetChar (the GVNFlags type is now 64bit in size).

Also improves the test case.

TEST=mjsunit/string-natives
R=mstarzinger@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/57383004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix windows build after r17521.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61943002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Another fix for windows breakage after r17521.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61953002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Correct handling of arrays with callbacks in the prototype chain.

Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Age ICs on context dispose notification.

R=ulan@chromium.org
BUG=309723

Review URL: https://codereview.chromium.org/59383012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Ensure that typed array constructors are crankshaftable.

Also, do not allocate sub-closures for every call to typed array constructor.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/59913003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Handlify ForceSetObjectProperty

Note that I've left the layering as is to make the diffs clear. Is it worth moving ForceSetObjectProperty to objects.cc? This code is clearly implementing part of the DefineOrRedefine steps from the spec, but it's still odd that it lives in Runtime. Note that handles.cc exposes a ForceSetProperty which just performs a CALL_HEAP_FUNCTION on the Runtime::ForceSetObjectProperty -- which is exposed to the api as v8::Object::ForceSet

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61883002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Change test expectations for webkit/fast/js/object-slow-put and friends.

R=verwaest@chromium.org
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/62213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add three string constants from parser to the root-set.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/62143002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17531 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Landing https://codereview.chromium.org/40133004 for mnita@google.com.

Implements ES6 String.prototype.normalize method.

BUG=v8:2943
TEST=Unit tests for "real life" use cases, edge cases, various types of normalization.
TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/60013010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Landing https://codereview.chromium.org/40133004 for mnita@google.com." due to test failures.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/62563002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00