Scanner: remove PushBack calls when we're going to return ILLEGAL.

This simplifies escape handling and makes it easier to extend escapes for ES6.

PushBack just before detecting ILLEGAL is unnecessary, since we will abort the
scanning / parsing anyway at that point, and it doesn't matter where the cursor
exactly is. The error messages w/ PushBack are not any better or more correct
than without.

In addition: remove a comment about handling invalid escapes gracefully when we
no longer do. (*)

This CL includes a behavioral change: For input "var r = /foobar/g\urrrr;" we
used to report "unexpected_token: ILLEGAL" for "\u", but now we report
malformed_regexp_flags which is a more correct error message. (Note that the
code for reporting invalid_regexp_flags was dead, and invalid_regexp_flags is
not the right error message.)

Note that the V8 is more relaxed about unicode escapes in regexp flags than ES6
(see
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-regular-expressions )
and this CL doesn't change it. (V8 accepts any \uxxxx, ES6 spec says only a
certain value range is acceptable.)

(*) Code archaeology:

Originally, doing PushBack in ScanHexEscape made sense (see e.g., here
https://codereview.chromium.org/5063003/diff/6001/src/prescanner.h ), since we
wouldn't return ILLEGAL but treat an invalid escape sequence "\uxxxx" as
"uxxxx".

(The repo at that point contains another instance of the same function, from the
initial commit. The logic is the same.)

This behavior was changed in a "renaming" commit
https://codereview.chromium.org/7739020.

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/684873002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Clear old backing store of WeakCollection on updates.

Not clearing can lead to a crash under following conditions:
1. Backing store of a weak map is allocated in large object space.
2. The backing store is marked incrementaly via the weak map.
3. The weak map is updated and gets a new backing store.
4. The store buffer overflows and marks the chunk of the old backing store as
"scan on scavenge."
5. Mark-compact collection kills some elements of the weak map. Note that the
old backing store survives because it was marked incrementally, but its dead
elements are not cleared.
6. Scavenger iterates over the old backing store, tries to move a dead object
and crashes.

BUG=v8:3631
LOG=N
TEST=cctest/test-heap/Regress3631
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/686783003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Switch auto push script to git.

BUG=410721
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/698513002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Skip tests for mips.

TBR=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/698513003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Upgrade test262-es6

TBR=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/695763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Properly handle stack overflows in the AST graph builder.

R=jarin@chromium.org
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159
LOG=N

Review URL: https://codereview.chromium.org/697473006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Break allocations in the code serializer into correct chunk sizes.

This change has been inspired by Slava Chigrin <vchigrin@yandex-team.ru> (https://codereview.chromium.org/689663002/)

R=mvstanton@chromium.org, vchigrin@yandex-team.ru

Review URL: https://codereview.chromium.org/686103004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Changing the aging mechanism for script and eval caches.
Instead of using multiple generations for the code, first only store the hash that gets aged. Once a hash matched on a next probe, actually cache the code. Use regular code aging to remove entries from the cache.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/675013004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Minor cleanup about unscheduled use count for fixed nodes.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/696643002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25041 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Skip the CallFunctionStub when the callee function can be statically determined.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/694773002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS64: Fix simulator arguments handling on generated code entry.

Removed workaround for this issue.

TEST=mjsunit, cctest on sim64
BUG=
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/695933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Skip the CallFunctionStub when the callee function can be statically determined."

This reverts commit 9845dfadd2ad4a83fa00bf43e0c2791ccf7eacad (r25042) for failing tests.

TBR=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/693103004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[turbofan] Avoid unnecessary (u)int32<->float64 changes in simplified lowering.

BUG=
R=bmeurer@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/683873002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Teach push script to commit with roll account.

BUG=410721
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/693333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix push script for autoroll account.

Push tags to the repo not to the remote - which is a cache
checkout on the bots.

Add new files when doing pure svn commits. Otherwise, new
files are silently ignored and not committed.

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/699493004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25049 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
IA: Double arithmetic binops support memory operand

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/662813002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[turbofan] Do not use the generic graph algorithm for widening in the typer.

This change uses an explicit queue for type-widening instead of the
generic algorithm. The trouble with the generic algorithm was that it
called the visitor on the same phi many times in a row (and thus caused
unnecessary retyping). I also think that the queue-based fixpoint is
more readable.

The CL cuts running time of the nbody-java benchmark from ~19s to ~15s,
the time spent in the typer goes from 4.5s to 1s. This is still a lot
- the root cause appears to be slow handling of union subtyping
(m*n for unions of sizes m and n). I see a re-typing of a
single phi node taking > 100ms. I will work on a fix with Andreas,
hopefully we can come up with some canonical representation
of unions at least for the common cases (union of Smi constants).

I have also changed the initial typer run to always compute a type, even
if we already had a type for the node. This fixes one assert failure
where context specialization updates a node without updating the type,
which confuses the typer when widening (as some types suddenly narrow).

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/689403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[x86] Fix register constraints for multiply high and modulus.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-register-allocator2

Review URL: https://codereview.chromium.org/697053002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
More retries when tagging in release scripts.

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/697433003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add workdir feature to release scripts.

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/701463002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00