deps: update V8 to 4.4.63.26

Includes cherry-picks for:
 * JitCodeEvent patch: https://crrev.com/f7969b1d5a55e66237221a463daf422ac7611788
 * argparse patch: https://crrev.com/44bc918458481d60b08d5566f0f31a79e39b85d7

PR-URL: https://github.com/nodejs/io.js/pull/2220
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

7 files changed, 237 insertions, 4 deletions

diff --git a/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js b/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js
new file mode 100644
index 0000000000..9bb313ffbe
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js
@@ -0,0 +1,80 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-proxies
+
+"use strict";
+
+
+var global = this;
+
+
+(function TestGlobalReceiver() {
+  class A {
+    s() {
+      super.bla = 10;
+    }
+  }
+  new A().s.call(global);
+  assertEquals(10, global.bla);
+})();
+
+
+(function TestProxyProto() {
+  var calls = 0;
+  var handler = {
+    getPropertyDescriptor: function(name) {
+      calls++;
+      return undefined;
+    }
+  };
+
+  var proto = {};
+  var proxy = Proxy.create(handler, proto);
+  var object = {
+    __proto__: proxy,
+    setX(v) {
+      super.x = v;
+    },
+    setSymbol(sym, v) {
+      super[sym] = v;
+    }
+  };
+
+  object.setX(1);
+  assertEquals(1, Object.getOwnPropertyDescriptor(object, 'x').value);
+  assertEquals(1, calls);
+
+  var sym = Symbol();
+  object.setSymbol.call(global, sym, 2);
+  assertEquals(2, Object.getOwnPropertyDescriptor(global, sym).value);
+  // We currently do not invoke proxy traps for symbols
+  assertEquals(1, calls);
+})();
+
+
+(function TestProxyReceiver() {
+  var object = {
+    setY(v) {
+      super.y = v;
+    }
+  };
+
+  var calls = 0;
+  var handler = {
+    getPropertyDescriptor(name) {
+      assertUnreachable();
+    },
+    set(receiver, name, value) {
+      calls++;
+      assertEquals(proxy, receiver);
+      assertEquals('y', name);
+      assertEquals(3, value);
+    }
+  };
+
+  var proxy = Proxy.create(handler);
+  object.setY.call(proxy, 3);
+  assertEquals(1, calls);
+})();
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index dfbe3b5d63..71a7de4ec7 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -561,10 +561,6 @@
   'math-floor-of-div-minus-zero': [SKIP],
 }],  # 'arch == mips64el'
 
-['arch == mips64el and simulator_run == False', {
-  # Random failures on HW, need investigation.
-  'debug-*': [SKIP],
-}],
 ##############################################################################
 ['system == windows', {
   # TODO(mstarzinger): Too slow with turbo fan.
diff --git a/deps/v8/test/mjsunit/regress/regress-487981.js b/deps/v8/test/mjsunit/regress/regress-487981.js
new file mode 100644
index 0000000000..829c25c59d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-487981.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags:  --allow-natives-syntax --stress-compaction
+
+// To reliably reproduce the crash use --verify-heap --random-seed=-133185440
+
+function __f_2(o) {
+  return o.field.b.x;
+}
+
+try {
+  %OptimizeFunctionOnNextCall(__f_2);
+  __v_1 = __f_2();
+} catch(e) { }
+
+function __f_3() { __f_3(/./.test()); };
+
+try {
+__f_3();
+} catch(e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-478612.js b/deps/v8/test/mjsunit/regress/regress-crbug-478612.js
new file mode 100644
index 0000000000..3419722cd0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-478612.js
@@ -0,0 +1,52 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This is used to force binary operations below to have tagged representation.
+var z = {valueOf: function() { return 3; }};
+
+
+function f() {
+  var y = -2;
+  return (1 & z) - y++;
+}
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
+
+
+function g() {
+  var y = 2;
+  return (1 & z) | y++;
+}
+
+assertEquals(3, g());
+assertEquals(3, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(3, g());
+
+
+function h() {
+  var y = 3;
+  return (3 & z) & y++;
+}
+
+assertEquals(3, h());
+assertEquals(3, h());
+%OptimizeFunctionOnNextCall(h);
+assertEquals(3, h());
+
+
+function i() {
+  var y = 2;
+  return (1 & z) ^ y++;
+}
+
+assertEquals(3, i());
+assertEquals(3, i());
+%OptimizeFunctionOnNextCall(i);
+assertEquals(3, i());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-500497.js b/deps/v8/test/mjsunit/regress/regress-crbug-500497.js
new file mode 100644
index 0000000000..9117440c2c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-500497.js
@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// New space must be at max capacity to trigger pretenuring decision.
+// Flags: --allow-natives-syntax --verify-heap --max-semi-space-size=1
+
+var global = [];  // Used to keep some objects alive.
+
+function Ctor() {
+  var result = {a: {}, b: {}, c: {}, d: {}, e: {}, f: {}, g: {}};
+  return result;
+}
+
+for (var i = 0; i < 120; i++) {
+  // Make the "a" property long-lived, while everything else is short-lived.
+  global.push(Ctor().a);
+  (function FillNewSpace() { new Array(10000); })();
+}
+
+// The bad situation is only triggered if Ctor wasn't optimized too early.
+assertUnoptimized(Ctor);
+// Optimized code for Ctor will pretenure the "a" property, so it will have
+// three allocations:
+// #1 Allocate the "result" object in new-space.
+// #2 Allocate the object stored in the "a" property in old-space.
+// #3 Allocate the objects for the "b" through "g" properties in new-space.
+%OptimizeFunctionOnNextCall(Ctor);
+for (var i = 0; i < 10000; i++) {
+  // At least one of these calls will run out of new space. The bug is
+  // triggered when it is allocation #3 that triggers GC.
+  Ctor();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-502930.js b/deps/v8/test/mjsunit/regress/regress-crbug-502930.js
new file mode 100644
index 0000000000..ef21a1a69e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-502930.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+var accessor_to_data_case = (function() {
+  var v = {};
+  Object.defineProperty(v, "foo", { get: function() { return 42; }, configurable: true});
+
+  var obj = {};
+  obj["boom"] = v;
+
+  Object.defineProperty(v, "foo", { value: 0, writable: true, configurable: true });
+  return obj;
+})();
+
+
+var data_to_accessor_case = (function() {
+  var v = {};
+  Object.defineProperty(v, "bar", { value: 0, writable: true, configurable: true });
+
+  var obj = {};
+  obj["bam"] = v;
+
+  Object.defineProperty(v, "bar", { get: function() { return 42; }, configurable: true});
+  return obj;
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-514268.js b/deps/v8/test/mjsunit/regress/regress-crbug-514268.js
new file mode 100644
index 0000000000..75d9970eed
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-514268.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+  a.pop();
+}
+function foo(a) {
+  assertEquals(2, a.length);
+  var d;
+  for (d in a) {
+    bar(a);
+  }
+  // If this fails, bar was not called exactly once.
+  assertEquals(1, a.length);
+}
+
+foo([1,2]);
+foo([2,3]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1,2]);