Don't inline Array.shift() if receiver map is not extensible.

TEST=mjsunit/regress/regress-crbug-405517
BUG=405517
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/491863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Auto-roll] Bump up version to 3.29.12.0

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/492213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Mark test-debug/RecursiveBreakpoints as flaky.

R=machenbach@chromium.org
BUG=v8:3525
LOG=N

Review URL: https://codereview.chromium.org/479793005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Get rid of the NONEXISTENT PropertyType

BUG=

Review URL: https://codereview.chromium.org/492433005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove last LookupOwnRealNamedProperty usage from runtime.cc

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/494663002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Get rid of all non-IC uses of LookupOwnRealNamedProperty

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/491023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Indirect LookupResult accesses over PropertyAccessInfo

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/495483003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Allow to combine quickcheck and no_variants in test driver.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/489343002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Simplify array iterator tests

R=arv@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/344223006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refactor parser Checkpoints.

Why this is better:

1) Not needing an extra template parameter for Checkpoints ctors. This was
especially confusing since the template parameter was named Parser and Parser is
also used as a type name and is also a concrete type. This CL makes it clear
that ParserTraits::Checkpoint is consturcted with ParserBase<ParserTraits> -
that's the only sensemaking type for the ctor param anyway.

2) This CL makes ParserBase define a Checkpoint base class (which knows how
to create and restore a checkpoint with ParserBase) which
PreParserTraits::Checkpoint and ParserTraits::Checkpoint inherit, and not the
other way around.

This is a more intuitive way to implement the "base functionality + extending
it" concept than the previous solution. The previous solution was to allow
Traits to define a Checkpoint class and make ParserBase<Traits>::ParserCheckpoint
(which defines the base functionality) inherit from it.

3) This CL moves the Checkpoint class definitions out of the SomeTraits::Type
struct; SomeTraits::Type is supposed to be a collection of typedefs and not
contain anything else.

Checkpoints were introduced in r22925 ( https://codereview.chromium.org/443903003 ).

BUG=
R=wingo@igalia.com

Review URL: https://codereview.chromium.org/485473004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Rename IsDontDelete to IsConfigurable (and invert conditions)

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/494063002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MSan: mark any memory allocated from the JS heap as uninitialized.

BUG=chromium:403409,chromium:178409
R=jkummerow@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/480763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/bleeding_edge' into bleeding_edge