Inline Array.shift() fast path instead of using a code stub.

TEST=mjsunit/array-shift,mjsunit/array-shift2,mjsunit/array-shift3
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/308793010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
PPC: upstream changes [673aa0324a382b68979ca7c97961419e1a2e8c19]
Handle HCheckInstanceType and HIsStringAndBranch in check elimination.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/300423003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21593 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Handle HCheckInstanceType and HIsStringAndBranch in check elimination."

This reverts commit r21593 for breaking the Webkit tests.

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/310593004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Clean up (Get|Set)Property(Attributes)WithFailedAccessChecks

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/309653003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove PROHIBITS_OVERWRITING as it is subsumed by non-configurable properties.

v8::DontDelete is set for Unforgeable properties, so just not setting PROHIBITS_OVERWRITING should be enough.

The secondary "feature" of not allowing accessors to be installed in extending objects is incorrect and confusing, given that it only applies to accessors but not to regular properties:
Object.defineProperty({__proto__:window}, "location", { value: 10 })
works where
Object.defineProperty({__proto__:window}, "location", { get: function() {} })
doesn't work.

LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/306203002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00