Scanner: remove PushBack calls when we're going to return ILLEGAL.

This simplifies escape handling and makes it easier to extend escapes for ES6.

PushBack just before detecting ILLEGAL is unnecessary, since we will abort the
scanning / parsing anyway at that point, and it doesn't matter where the cursor
exactly is. The error messages w/ PushBack are not any better or more correct
than without.

In addition: remove a comment about handling invalid escapes gracefully when we
no longer do. (*)

This CL includes a behavioral change: For input "var r = /foobar/g\urrrr;" we
used to report "unexpected_token: ILLEGAL" for "\u", but now we report
malformed_regexp_flags which is a more correct error message. (Note that the
code for reporting invalid_regexp_flags was dead, and invalid_regexp_flags is
not the right error message.)

Note that the V8 is more relaxed about unicode escapes in regexp flags than ES6
(see
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-regular-expressions )
and this CL doesn't change it. (V8 accepts any \uxxxx, ES6 spec says only a
certain value range is acceptable.)

(*) Code archaeology:

Originally, doing PushBack in ScanHexEscape made sense (see e.g., here
https://codereview.chromium.org/5063003/diff/6001/src/prescanner.h ), since we
wouldn't return ILLEGAL but treat an invalid escape sequence "\uxxxx" as
"uxxxx".

(The repo at that point contains another instance of the same function, from the
initial commit. The logic is the same.)

This behavior was changed in a "renaming" commit
https://codereview.chromium.org/7739020.

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/684873002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Clear old backing store of WeakCollection on updates.

Not clearing can lead to a crash under following conditions:
1. Backing store of a weak map is allocated in large object space.
2. The backing store is marked incrementaly via the weak map.
3. The weak map is updated and gets a new backing store.
4. The store buffer overflows and marks the chunk of the old backing store as
"scan on scavenge."
5. Mark-compact collection kills some elements of the weak map. Note that the
old backing store survives because it was marked incrementally, but its dead
elements are not cleared.
6. Scavenger iterates over the old backing store, tries to move a dead object
and crashes.

BUG=v8:3631
LOG=N
TEST=cctest/test-heap/Regress3631
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/686783003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Switch auto push script to git.

BUG=410721
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/698513002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Skip tests for mips.

TBR=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/698513003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Upgrade test262-es6

TBR=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/695763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/bleeding_edge' into bleeding_edge