Correct handling of arrays with callbacks in the prototype chain.

Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Age ICs on context dispose notification.

R=ulan@chromium.org
BUG=309723

Review URL: https://codereview.chromium.org/59383012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Ensure that typed array constructors are crankshaftable.

Also, do not allocate sub-closures for every call to typed array constructor.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/59913003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Handlify ForceSetObjectProperty

Note that I've left the layering as is to make the diffs clear. Is it worth moving ForceSetObjectProperty to objects.cc? This code is clearly implementing part of the DefineOrRedefine steps from the spec, but it's still odd that it lives in Runtime. Note that handles.cc exposes a ForceSetProperty which just performs a CALL_HEAP_FUNCTION on the Runtime::ForceSetObjectProperty -- which is exposed to the api as v8::Object::ForceSet

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61883002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Change test expectations for webkit/fast/js/object-slow-put and friends.

R=verwaest@chromium.org
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/62213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add three string constants from parser to the root-set.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/62143002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17531 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Landing https://codereview.chromium.org/40133004 for mnita@google.com.

Implements ES6 String.prototype.normalize method.

BUG=v8:2943
TEST=Unit tests for "real life" use cases, edge cases, various types of normalization.
TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/60013010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Landing https://codereview.chromium.org/40133004 for mnita@google.com." due to test failures.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/62563002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Correct handling of arrays with callbacks in the prototype chain.

Port r17525 (55b95f3)

Original commit message:
Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/63083002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Improve implementation of HSeqStringSetChar.

Port r17521 (c51c75e)

Original commit message:
This improves the generated code for HSeqStringSetChar across
all platforms, taking advantage of constant operands whenever
possible. It also drops the unused DefineSameAsFirst constraint
for the register allocator on x64 and ia32, where it caused
unnecessary spills when the string operand was live across the
HSeqStringSetChar instruction.

A new GVN flag StringChars is introduced to express dependencies
between HSeqStringSetChar, HStringCharCodeAt and the upcoming
HSeqStringGetChar (the GVNFlags type is now 64bit in size).

Also improves the test case.

TEST=mjsunit/string-natives
BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/61893003

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Move movq(Register, ExternalReference) into X64 MacroAssembler

R=danno@chromium.org

Review URL: https://codereview.chromium.org/43333003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17537 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix WIN64 build

Review URL: https://codereview.chromium.org/63703002

Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17538 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refactored ObjectSerializer::VisitFoo functions.

Tiny superficial cleanup to make the similarities more visible.
Removed a few useless assertions on the way.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/60363006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17539 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refactor loading a pointer and loading an integer64 into a register instructions for X64

R=danno@chromium.org

Review URL: https://codereview.chromium.org/39543003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Removed useless getter/setter.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/64013002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix y-umlaut to uppercase.

R=dcarney@chromium.org
BUG=v8:2984

Review URL: https://codereview.chromium.org/59853006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refine CountOperation of FullCodeGen

R=danno@chromium.org

Review URL: https://codereview.chromium.org/42973002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Turn Load/StoreGlobal into a handler.

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/26968004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17550 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove DisallowHeapAllocation requirement now that the target() is cached on the IC.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/61773004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17551 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Cleanup stub-cache's obsolete ComputeLoad/Store interface.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/64023003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@17554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00