v8: Upgrade 3.26.33 with 14 patches

V8 3.26.31 has received 14 patches since the upgrade to 3.26.33. Since
3.26.33 is technically a tag on the 3.27 branch, reverting back to
3.26.31 would remove now default functionality like WeakMaps. Because of
that the patches have simply been cherry-picked and squashed.

Here is a summary of all patches:

* Fix index register assignment in LoadFieldByIndex for arm, arm64, and
  mips.
* Fix invalid attributes when generalizing because of incompatible map
  change.
* Skip write barriers when updating the weak hash table.
* MIPS: Avoid HeapObject check in HStoreNamedField.
* Do GC if CodeRange fails to allocate a block.
* Array.concat: properly go to dictionary mode when required.
* Keep CodeRange::current_allocation_block_index_ in range.
* Grow heap slower if GC freed many global handles.
* Do not eliminate bounds checks for "<const> - x".
* Add missing map check to optimized f.apply(...).
* In GrowMode, force the value to the right representation to avoid
  deopts between storing the length and storing the value.
* Reduce max executable size limit.
* Fix invalid condition in check elimination effects.
* Fix off-by-one error in Array.concat slow mode check.

For more information see: https://github.com/v8/v8/commits/3.26

Reviewed-By: Fedor Indutny <fedor@indutny.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/regress/regress-386034.js b/deps/v8/test/mjsunit/regress/regress-386034.js
new file mode 100644
index 0000000000..d770ce91bd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-386034.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+  var v = x;
+  for (i = 0; i < 1; i++) {
+    v.apply(this, arguments);
+  }
+}
+
+function g() {}
+
+f(g);
+f(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(function() { f('----'); }, TypeError);