Reland and fix "Fix LoadFieldByIndex to take mutable heap-numbers into account.""

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218663005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make sure when we shrink an object that we store a filler first into the free memory before updating the map or size.

BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/219103002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix left trimming check for large objects

BUG=358090
TEST=test/mjsunit/regress/regress-358090.js
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/213833008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix PrepareKeyedOperand on arm.

When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

R=verwaest@chromium.org
BUG=358057
LOG=Y

Review URL: https://codereview.chromium.org/219473002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Replace set_map_and_elements by MigrateToMap-based SetMapAndElements

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218753005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Update list of V8 try bots.

R=jarin@chromium.org
TBR=jarin@chromium.org
BUG=353487
LOG=n

Review URL: https://codereview.chromium.org/219493002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix Type::Intersect to skip uninhabited bitsets

R=verwaest@chromium.org, bmeurer@chromium.org
BUG=chromium:357330
LOG=Y

Review URL: https://codereview.chromium.org/219333003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Use JSObject::SetMapAndElements rather than set_map + set_elements.

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218583008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
We should perform the illegal redeclaration check earlier so that we do not confuse the AST typer with missing type feedback nodes.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/218493007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Reland and fix "Fix LoadFieldByIndex to take mutable heap-numbers into account."

Port r20358 (5e9b653d)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219163010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Fix PrepareKeyedOperand on MIPS.

Port r20363 (235f866c)

Original commit message:
When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219923005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Store i18n meta data in hidden symbols instead of js accessible properties

There were some tests that are supposed to protect against js messing
with the meta data, however, they just didn't try hard enough.

BUG=354967
R=dcarney@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/215293005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Only assign environments when they are actually needed. (ARM and ARM64 only)

Twin of https://codereview.chromium.org/210783003/ and https://codereview.chromium.org/211153003/.

Cleaned up DoChange a bit on the way, making things more uniform across platforms, removed useless comments etc.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/214613004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20376 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert r20375.

Store i18n meta data in hidden symbols instead of js accessible properties

BUG=354967
LOG=N
TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/220673002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Tighten object verification.

Often, when we call MaybeObject::Verify, what we want is Object::ObjectVerify.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218993005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fixed power-of-2 predicates, excluding 0.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/219213003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20383 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Set kTruncatingToSmi for HChange only when To rep is Smi

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/218613002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fixed assertions on ARM64.

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/220763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Only allow automatic FrameScope types for FrameAndConstantPoolScope

In certain situations the PP register would be invalid in a FrameScope::Manual FrameAndConstantPoolScope

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/214623002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Store i18n meta data in hidden symbols instead of js accessible properties

There were some tests that are supposed to protect against js messing
with the meta data, however, they just didn't try hard enough.

BUG=354967
R=dcarney@chromium.org
LOG=y

Committed: https://code.google.com/p/v8/source/detail?r=20375

Review URL: https://codereview.chromium.org/215293005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@20388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00