Don't inline Array.shift() if receiver map is not extensible.

TEST=mjsunit/regress/regress-crbug-405517
BUG=405517
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/491863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Auto-roll] Bump up version to 3.29.12.0

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/492213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Mark test-debug/RecursiveBreakpoints as flaky.

R=machenbach@chromium.org
BUG=v8:3525
LOG=N

Review URL: https://codereview.chromium.org/479793005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Get rid of the NONEXISTENT PropertyType

BUG=

Review URL: https://codereview.chromium.org/492433005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove last LookupOwnRealNamedProperty usage from runtime.cc

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/494663002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Get rid of all non-IC uses of LookupOwnRealNamedProperty

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/491023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Indirect LookupResult accesses over PropertyAccessInfo

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/495483003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Allow to combine quickcheck and no_variants in test driver.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/489343002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Simplify array iterator tests

R=arv@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/344223006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refactor parser Checkpoints.

Why this is better:

1) Not needing an extra template parameter for Checkpoints ctors. This was
especially confusing since the template parameter was named Parser and Parser is
also used as a type name and is also a concrete type. This CL makes it clear
that ParserTraits::Checkpoint is consturcted with ParserBase<ParserTraits> -
that's the only sensemaking type for the ctor param anyway.

2) This CL makes ParserBase define a Checkpoint base class (which knows how
to create and restore a checkpoint with ParserBase) which
PreParserTraits::Checkpoint and ParserTraits::Checkpoint inherit, and not the
other way around.

This is a more intuitive way to implement the "base functionality + extending
it" concept than the previous solution. The previous solution was to allow
Traits to define a Checkpoint class and make ParserBase<Traits>::ParserCheckpoint
(which defines the base functionality) inherit from it.

3) This CL moves the Checkpoint class definitions out of the SomeTraits::Type
struct; SomeTraits::Type is supposed to be a collection of typedefs and not
contain anything else.

Checkpoints were introduced in r22925 ( https://codereview.chromium.org/443903003 ).

BUG=
R=wingo@igalia.com

Review URL: https://codereview.chromium.org/485473004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Rename IsDontDelete to IsConfigurable (and invert conditions)

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/494063002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MSan: mark any memory allocated from the JS heap as uninitialized.

BUG=chromium:403409,chromium:178409
R=jkummerow@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/480763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix symbol-named function template properties in the API

Thanks to Yutaka Hirano <yhirano@chromium.org> for finding the bug and
providing the test case.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/496663002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Initial support for debugger frame state in Turbofan.

Bunch of changes were necessary:
- refactor attaching the frame states/lazy bailouts in AstGraphBuilder
  (essentialy reland of r23096),
- attaching frame state to some JS nodes in a similar way to attaching
  context (this is quite ugly and we should take another look at this),
- new bailout point for the debugger statement,
- register allocation constraints for the frame states,
- generating translations and deopt entries, attaching them to
  safepoints,
- enabled one mjsunit test for debugger state that uses the generated
  frame state.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/492203002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix clang/win build.

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/494973004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Stage ES6 generators

R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/479543003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix parsing of --gtest_list_tests output.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/485273004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement Function.prototype.toMethod.

R=arv@chromium.org, verwaest@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/475423003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23274 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Reland "Load global object and builtins from activation."

Reland fixes:
Don't set string flags (doing so leaks memory).

Load closure from activation for building literals.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/484273003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add missing ConstantPoolUnavailableScopes on JS return.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/494733002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23276 ce2b1a6d-e550-0410-aec6-3dcde31c8c00