Fix representation of Phis for mutable-heapnumber-in-object-literal properties

BUG=v8:3392
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/328343004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Reuse AstValueFactory when optimizing.

HOptimizedGraphBuilder::TryInline creates a temporary CompilationInfo and
destroys it, but we don't want the AstValueFactory to be destroyed at the same
time. Reuse the upper CompilationInfo's AstValueFactory.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/334173003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "GVN fix, preventing loads hoisting above stores to the same field when HObjectAccess's representation is not the same."

This reverts commit r21830 for tanking performance on Deltablue.

TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/336223002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21857 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add unit test for regression in GVN caused by field type tracking.

BUG=v8:3347
LOG=n
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/333273004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Do not eliminate bounds checks for "<const> - x".

Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".

R=yangguo@chromium.org
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N

Review URL: https://codereview.chromium.org/339583003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00