Reland "Enable Object.observe by default" again

This re-re-re-lands enabling Object.observe. The Chromium tests that
failed last time this was rolled into Chromium have been disabled in
https://src.chromium.org/viewvc/chrome?view=revision&revision=256706

This patch should be safe to merge once that lands.

BUG=v8:2409
LOG=Y
TBR=rossberg@chromium.org,dslomov@chromium.org,rafaelw@chromium.org

Review URL: https://codereview.chromium.org/198383002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19868 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Prepare push to trunk.  Now working on version 3.25.10.

R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/195873008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix uses of range analysis results in HChange.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/195023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19872 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Implement PersistentValueMap, a map that stores UniquePersistent values.
This is preparatory work to get rid of UnsafePersistent in blink.

The previous version had to be reverted due to timeouts in win32/Debug: https://codereview.chromium.org/197173002/

The timeouts happened because the STL version on that platform contains sanity checking code which opens a 'debug window' in the GUI, patiently waiting for the user to click ok/cancel/somethirdoption. It turns out, the cause for that debug window was totally valid and the test had a use-after-free issue.

The 1st patch set is the code as before. The 2nd patch set contains the fix.

Related blink changes are here: https://codereview.chromium.org/180363004/

This patch is largely based on https://codereview.chromium.org/175503003/, with some methods added to support the blink change mentioned above.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/197263002

Patch from Daniel Vogelheim <vogelheim@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix of argument materialization of captured heap numbers.

The escape analysis calculates the number of slots in an object as
no-of-slots = object-size / pointer-size.  This gives 3 slots for
heap numbers on 32-bit architectures (one slot for the map, two for
the double value); however, my argument materialization code assumed
just two slots (map + value). Since Hydrogen allocates heap numbers
quite rarely, it is hard to produce a more meaningful repro than the
one provided by Clusterfuzz. Any suggestions are welcome.

The fix is simple - we just read out all extra slots (beyond the map
and the double) for heap numbers.

R=mstarzinger@chromium.org
BUG=351315
LOG=N

Review URL: https://codereview.chromium.org/196283004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19874 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove SnapshotFillerInterface

There used to be additional pass in the heap profiler that estimated memory required for the snapshot and it used special implementation of the interface. Now that we dropped that step it doesn't makes sense to keep the interface with single implementation.

BUG=None
LOG=N
R=loislo@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/194503002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add file exclusion to trunk patch creation in push-to-trunk.

This is another step towards getting rid of the bleeding edge change log file. Now it can be omitted in a follow up CL.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/197023004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19876 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove uses of RangeCanInclude() in flooring division by power of 2.

Drive-By-Fix: Improve ARM code generation for flooring division by
power of 2.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/196653009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19877 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove uses of CanBeNegative() in HMod.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/195793016

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
move remaining uses of scanner literals into scanner

R=marja@chromium.org

BUG=

Review URL: https://codereview.chromium.org/198713002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
New Compilation API, part 1

- Distinguish between context bound scripts (Script) and context unbound scripts
(UnboundScript).
- Add ScriptCompiler (which will later contain functions for async compilation).

This is a breaking change, in particular, Script::New no longer exists (it is
replaced by ScriptCompiler::CompileUnbound). Script::Compile remains as a
backwards-compatible shorthand for ScriptCompiler::Compile.

Passing CompilerOptions with produce_data_to_cache = true doesn't do anything
yet; the only way to generate the data to cache is the old preparsing API. (To
be fixed in the next version.)

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/186723005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "New Compilation API, part 1"

This reverts revision 19881.

Reason: WebKit build failure (will commit a fixed version shortly).

BUG=

Review URL: https://codereview.chromium.org/196793013

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Convert scanner buffers to use standard character types.

R=marja@chromium.org

BUG=

Review URL: https://codereview.chromium.org/198583003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make translation of modulus operation '--stress-opt'-proof.

Note that we unconditionally deopt later, anyway, but our compilation
pipeline has to survive long enough to reach that place. :-/

LOG=y
BUG=352059
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/198833002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
A64: Fix Fmov with signalling NaN literals.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/194753002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Harmony: move math features to es-staging.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/195123002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
A64: Remove an invalid assertion about the position of the reloc_info_writer.

Review URL: https://codereview.chromium.org/196413007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add ASAN option to stand-alone gyp config.

BUG=
R=jkummerow@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/196943004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Turn StringLengthStub (used by string wrappers only) into a hydrogen stub.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/197603002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Check that constant is an integer before getting its value in HGraphBuilder::MatchRotateRight.

BUG=351263
LOG=N
TEST=mjsunit/regress/regress-351263
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/197803005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@19890 ce2b1a6d-e550-0410-aec6-3dcde31c8c00