Make Object.freeze fast

This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

Relanding r14758 and r14759 with fix for Test262: only mark properties
and elements READ_ONLY if they are not JS setter/getters. Tightened up
tests to assert frozen-ness, and added targeted tests for the new code
(covering accessors).

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15691007

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Move global pretenuring flag check to ShouldGloballyPretenure().

BUG=

Review URL: https://codereview.chromium.org/15734007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
de-isolate Persistent::Dispose

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15648008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement HChange support for Smis and use it in Load/StoreNameField

BUG=
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15303004

Patch from Daniel Clifford <danno@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Avoid creating duplicate entries for a value when merging HSimulates

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/15660003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Omit smi-check for write-barrier unless tagged.

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15848002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14767 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Always require exact maps.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/13923003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Improve SeqStringSetChar implementation.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/15743006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Externalization API for ArrayBuffer

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15001041

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix Windows build after r14770

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15848003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14771 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Don't use fast literal if the boilerplate map is still deprecated.

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15660005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Missing type cell on ia32 from bindings.

Javascript constructors called from C++ code didn't have a type cell
properly filled in on ia32. This showed up as a bug in webkit bindings.
Re-enabled flag optimize-constructed-arrays.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/15870002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add asserts to String::GetFlatContent.

R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13841012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix embedded new-space pointer in LCmpObjectEqAndBranch.

R=mvstanton@chromium.org
BUG=chromium:240032
TEST=mjsunit/regress/regress-crbug-240032

Review URL: https://codereview.chromium.org/15779004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Tag length of FixedArrayBase and smi-array[x] as smi representation

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15858006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Require smi for keyed store to smi.

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15884002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14779 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Simplifying GC heuristics, deleted old generation allocation limit.

BUG=

Review URL: https://codereview.chromium.org/14700006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix assert on ARM

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15886004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@14781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00