Better threaded fuzzing for TestFunctionCallOptimization

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/182863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19567 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement and enable zapping of code space while sweeping.

R=danno@chromium.org, hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/181513004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19568 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Better threaded fuzzing for TestFunctionCallOptimization"

This reverts commit 19567.

TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/182893003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix for Clusterfuzz issue 343928.

The problem was that the debugger didn't expect that a JSFunction could
have a GlobalContext, which it can with harmony scoping.

BUG=343928
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/183103003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix bogus assertion in SetFastDoubleElements.

R=danno@chromium.org
BUG=347530
LOG=N

Review URL: https://codereview.chromium.org/181433016

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Handle arguments objects in frame when materializing arguments

R=mstarzinger@chromium.org
BUG=347262

Review URL: https://codereview.chromium.org/177293009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Merge remote-tracking branch 'upstream/bleeding_edge' into bleeding_edge