Update V8 to r5136 as required by WebKit r64264

Change-Id: I55b86fa101d9d53e889e2e3811fdf75f463ac3c6

8 files changed, 314 insertions, 12 deletions

diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index bd6108c0..82b93c95 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -8015,9 +8015,10 @@ TEST(DontLeakGlobalObjects) {
 v8::Persistent<v8::Object> some_object;
 v8::Persistent<v8::Object> bad_handle;
 
-void NewPersistentHandleCallback(v8::Persistent<v8::Value>, void*) {
+void NewPersistentHandleCallback(v8::Persistent<v8::Value> handle, void*) {
   v8::HandleScope scope;
   bad_handle = v8::Persistent<v8::Object>::New(some_object);
+  handle.Dispose();
 }
 
 
@@ -8046,6 +8047,7 @@ v8::Persistent<v8::Object> to_be_disposed;
 void DisposeAndForceGcCallback(v8::Persistent<v8::Value> handle, void*) {
   to_be_disposed.Dispose();
   i::Heap::CollectAllGarbage(false);
+  handle.Dispose();
 }
 
 
@@ -8070,6 +8072,7 @@ void DisposingCallback(v8::Persistent<v8::Value> handle, void*) {
 void HandleCreatingCallback(v8::Persistent<v8::Value> handle, void*) {
   v8::HandleScope scope;
   v8::Persistent<v8::Object>::New(v8::Object::New());
+  handle.Dispose();
 }
 
 
diff --git a/test/cctest/test-assembler-arm.cc b/test/cctest/test-assembler-arm.cc
index 5e49c0cd..9033f4b8 100644
--- a/test/cctest/test-assembler-arm.cc
+++ b/test/cctest/test-assembler-arm.cc
@@ -310,4 +310,38 @@ TEST(5) {
   }
 }
 
+
+TEST(6) {
+  // Test saturating instructions.
+  InitializeVM();
+  v8::HandleScope scope;
+
+  Assembler assm(NULL, 0);
+
+  if (CpuFeatures::IsSupported(ARMv7)) {
+    CpuFeatures::Scope scope(ARMv7);
+    __ usat(r1, 8, Operand(r0));           // Sat 0xFFFF to 0-255 = 0xFF.
+    __ usat(r2, 12, Operand(r0, ASR, 9));  // Sat (0xFFFF>>9) to 0-4095 = 0x7F.
+    __ usat(r3, 1, Operand(r0, LSL, 16));  // Sat (0xFFFF<<16) to 0-1 = 0x0.
+    __ add(r0, r1, Operand(r2));
+    __ add(r0, r0, Operand(r3));
+    __ mov(pc, Operand(lr));
+
+    CodeDesc desc;
+    assm.GetCode(&desc);
+    Object* code = Heap::CreateCode(desc,
+                                    Code::ComputeFlags(Code::STUB),
+                                    Handle<Object>(Heap::undefined_value()));
+    CHECK(code->IsCode());
+#ifdef DEBUG
+    Code::cast(code)->Print();
+#endif
+    F1 f = FUNCTION_CAST<F1>(Code::cast(code)->entry());
+    int res = reinterpret_cast<int>(
+                CALL_GENERATED_CODE(f, 0xFFFF, 0, 0, 0, 0));
+    ::printf("f() = %d\n", res);
+    CHECK_EQ(382, res);
+  }
+}
+
 #undef __
diff --git a/test/cctest/test-disasm-arm.cc b/test/cctest/test-disasm-arm.cc
index 2bb32e7f..0ba4f9ae 100644
--- a/test/cctest/test-disasm-arm.cc
+++ b/test/cctest/test-disasm-arm.cc
@@ -396,6 +396,15 @@ TEST(Type3) {
             "e7df0f91       bfi r0, r1, #31, #1");
     COMPARE(bfi(r1, r0, 31, 1),
             "e7df1f90       bfi r1, r0, #31, #1");
+
+    COMPARE(usat(r0, 1, Operand(r1)),
+            "e6e10011       usat r0, #1, r1");
+    COMPARE(usat(r2, 7, Operand(lr)),
+            "e6e7201e       usat r2, #7, lr");
+    COMPARE(usat(r3, 31, Operand(r4, LSL, 31)),
+            "e6ff3f94       usat r3, #31, r4, lsl #31");
+    COMPARE(usat(r8, 0, Operand(r5, ASR, 17)),
+            "e6e088d5       usat r8, #0, r5, asr #17");
   }
 
   VERIFY_RUN();
diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index 01f23aa1..2c286e3f 100644
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -322,8 +322,8 @@ static bool WeakPointerCleared = false;
 
 static void TestWeakGlobalHandleCallback(v8::Persistent<v8::Value> handle,
                                          void* id) {
-  USE(handle);
   if (1234 == reinterpret_cast<intptr_t>(id)) WeakPointerCleared = true;
+  handle.Dispose();
 }
 
 
@@ -398,17 +398,8 @@ TEST(WeakGlobalHandlesMark) {
 
   CHECK(WeakPointerCleared);
   CHECK(!GlobalHandles::IsNearDeath(h1.location()));
-  CHECK(GlobalHandles::IsNearDeath(h2.location()));
 
   GlobalHandles::Destroy(h1.location());
-  GlobalHandles::Destroy(h2.location());
-}
-
-static void TestDeleteWeakGlobalHandleCallback(
-    v8::Persistent<v8::Value> handle,
-    void* id) {
-  if (1234 == reinterpret_cast<intptr_t>(id)) WeakPointerCleared = true;
-  handle.Dispose();
 }
 
 TEST(DeleteWeakGlobalHandle) {
@@ -427,7 +418,7 @@ TEST(DeleteWeakGlobalHandle) {
 
   GlobalHandles::MakeWeak(h.location(),
                           reinterpret_cast<void*>(1234),
-                          &TestDeleteWeakGlobalHandleCallback);
+                          &TestWeakGlobalHandleCallback);
 
   // Scanvenge does not recognize weak reference.
   Heap::PerformScavenge();
diff --git a/test/cctest/test-mark-compact.cc b/test/cctest/test-mark-compact.cc
index 5c7b57cf..e4ac1b7c 100644
--- a/test/cctest/test-mark-compact.cc
+++ b/test/cctest/test-mark-compact.cc
@@ -273,6 +273,7 @@ TEST(GCCallback) {
 static int NumberOfWeakCalls = 0;
 static void WeakPointerCallback(v8::Persistent<v8::Value> handle, void* id) {
   NumberOfWeakCalls++;
+  handle.Dispose();
 }
 
 TEST(ObjectGroups) {
diff --git a/test/mjsunit/debug-setbreakpoint.js b/test/mjsunit/debug-setbreakpoint.js
index 8201d639..90dfcd13 100644
--- a/test/mjsunit/debug-setbreakpoint.js
+++ b/test/mjsunit/debug-setbreakpoint.js
@@ -192,3 +192,26 @@ Debug.setListener(breakListener);
 sourceUrlFunc();
 
 assertTrue(breakListenerCalled, "Break listener not called on breakpoint set by sourceURL");
+
+
+// Breakpoint in a script with no statements test case. If breakpoint is set
+// to the script body, its actual position is taken from the nearest statement
+// below or like in this case is reset to the very end of the script.
+// Unless some precautions made, this position becomes out-of-range and
+// we get an exception.
+
+// Gets a script of 'i1' function and sets the breakpoint at line #4 which
+// should be empty.
+function SetBreakpointInI1Script() {
+  var i_script = Debug.findScript(i1);
+  assertTrue(!!i_script, "invalid script for i1");
+  Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId,
+                            i_script.id, 4);
+}
+
+// Creates the eval script and tries to set the breakpoint.
+// The tricky part is that the script function must be strongly reachable at the
+// moment. Since there's no way of simply getting the pointer to the function,
+// we run this code while the script function is being activated on stack.
+eval('SetBreakpointInI1Script()\nfunction i1(){}\n\n\n\nfunction i2(){}\n');
+
diff --git a/test/mjsunit/for-in-special-cases.js b/test/mjsunit/for-in-special-cases.js
index 3c54256e..b592ad25 100644
--- a/test/mjsunit/for-in-special-cases.js
+++ b/test/mjsunit/for-in-special-cases.js
@@ -62,3 +62,60 @@ for (var j = 0; j < 10; ++j) {
 assertEquals(10, i);
 assertEquals(10, j);
 
+
+function Accumulate(x) {
+  var accumulator = "";
+  for (var i in x) {
+    accumulator += i;
+  }
+  return accumulator;
+}
+
+for (var i = 0; i < 3; ++i) {
+  var elements = Accumulate("abcd");
+  // We do not assume that for-in enumerates elements in order.
+  assertTrue(-1 != elements.indexOf("0"));
+  assertTrue(-1 != elements.indexOf("1"));
+  assertTrue(-1 != elements.indexOf("2"));
+  assertTrue(-1 != elements.indexOf("3"));
+  assertEquals(4, elements.length);
+}
+
+function for_in_string_prototype() {
+
+  var x = new String("abc");
+  x.foo = 19;
+  function B() {
+    this.bar = 5;
+    this[7] = 4;
+  }
+  B.prototype = x;
+
+  var y = new B();
+  y.gub = 13;
+
+  var elements = Accumulate(y);
+  var elements1 = Accumulate(y);
+  // If for-in returns elements in a different order on multiple calls, this
+  // assert will fail.  If that happens, consider if that behavior is OK.
+  assertEquals(elements, elements1, "For-in elements not the same both times.");
+  // We do not assume that for-in enumerates elements in order.
+  assertTrue(-1 != elements.indexOf("0"));
+  assertTrue(-1 != elements.indexOf("1"));
+  assertTrue(-1 != elements.indexOf("2"));
+  assertTrue(-1 != elements.indexOf("7"));
+  assertTrue(-1 != elements.indexOf("foo"));
+  assertTrue(-1 != elements.indexOf("bar"));
+  assertTrue(-1 != elements.indexOf("gub"));
+  assertEquals(13, elements.length);
+
+  elements = Accumulate(x);
+  assertTrue(-1 != elements.indexOf("0"));
+  assertTrue(-1 != elements.indexOf("1"));
+  assertTrue(-1 != elements.indexOf("2"));
+  assertTrue(-1 != elements.indexOf("foo"));
+  assertEquals(6, elements.length);
+}
+
+for_in_string_prototype();
+for_in_string_prototype();
diff --git a/test/mjsunit/function-bind.js b/test/mjsunit/function-bind.js
new file mode 100644
index 00000000..7a72cd5e
--- /dev/null
+++ b/test/mjsunit/function-bind.js
@@ -0,0 +1,184 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests the Function.prototype.bind (ES 15.3.4.5) method.
+
+// Simple tests.
+function foo(x, y, z) {
+  return x + y + z;
+}
+
+var f = foo.bind(foo);
+assertEquals(3, f(1, 1, 1));
+assertEquals(3, f.length);
+
+f = foo.bind(foo, 2);
+assertEquals(4, f(1, 1));
+assertEquals(2, f.length);
+
+f = foo.bind(foo, 2, 2);
+assertEquals(5, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo, 2, 2, 2);
+assertEquals(6, f());
+assertEquals(0, f.length);
+
+// Test that length works correctly even if more than the actual number
+// of arguments are given when binding.
+f = foo.bind(foo, 1, 2, 3, 4, 5, 6, 7, 8, 9);
+assertEquals(6, f());
+assertEquals(0, f.length);
+
+// Use a different bound object.
+var obj = {x: 42, y: 43};
+// Values that would normally be in "this" when calling f_bound_this.
+var x = 42;
+var y = 44;
+
+function f_bound_this(z) {
+  return z + this.y - this.x;
+} 
+
+assertEquals(3, f_bound_this(1))
+f = f_bound_this.bind(obj);
+assertEquals(2, f(1));
+assertEquals(1, f.length);
+
+f = f_bound_this.bind(obj, 2);
+assertEquals(3, f());
+assertEquals(0, f.length);
+
+// Test chained binds.
+
+// When only giving the thisArg, any number of binds should have 
+// the same effect.
+f = foo.bind(foo);
+assertEquals(3, f(1, 1, 1));
+f = foo.bind(foo).bind(foo).bind(foo).bind(foo);
+assertEquals(3, f(1, 1, 1));
+assertEquals(3, f.length);
+
+// Giving bound parameters should work at any place in the chain.
+f = foo.bind(foo, 1).bind(foo).bind(foo).bind(foo);
+assertEquals(3, f(1, 1));
+assertEquals(2, f.length);
+
+f = foo.bind(foo).bind(foo, 1).bind(foo).bind(foo);
+assertEquals(3, f(1, 1));
+assertEquals(2, f.length);
+
+f = foo.bind(foo).bind(foo).bind(foo,1 ).bind(foo);
+assertEquals(3, f(1, 1));
+assertEquals(2, f.length);
+
+f = foo.bind(foo).bind(foo).bind(foo).bind(foo, 1);
+assertEquals(3, f(1, 1));
+assertEquals(2, f.length);
+
+// Several parameters can be given, and given in different bind invokations.
+f = foo.bind(foo, 1, 1).bind(foo).bind(foo).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo).bind(foo, 1, 1).bind(foo).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo).bind(foo, 1, 1).bind(foo).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo).bind(foo).bind(foo, 1, 1).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo).bind(foo).bind(foo).bind(foo, 1, 1);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo, 1).bind(foo, 1).bind(foo).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo, 1).bind(foo).bind(foo, 1).bind(foo);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo, 1).bind(foo).bind(foo).bind(foo, 1);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+f = foo.bind(foo).bind(foo, 1).bind(foo).bind(foo, 1);
+assertEquals(3, f(1));
+assertEquals(1, f.length);
+
+// Test constructor calls.
+
+function bar(x, y, z) {
+  this.x = x;
+  this.y = y;
+  this.z = z;
+}
+
+f = bar.bind(bar);
+var obj2 = new f(1,2,3);
+assertEquals(1, obj2.x);
+assertEquals(2, obj2.y);
+assertEquals(3, obj2.z);
+
+f = bar.bind(bar, 1);
+obj2 = new f(2,3);
+assertEquals(1, obj2.x);
+assertEquals(2, obj2.y);
+assertEquals(3, obj2.z);
+
+f = bar.bind(bar, 1, 2);
+obj2 = new f(3);
+assertEquals(1, obj2.x);
+assertEquals(2, obj2.y);
+assertEquals(3, obj2.z);
+
+f = bar.bind(bar, 1, 2, 3);
+obj2 = new f();
+assertEquals(1, obj2.x);
+assertEquals(2, obj2.y);
+assertEquals(3, obj2.z);
+
+
+// Test bind chains when used as a constructor.
+
+f = bar.bind(bar, 1).bind(bar, 2).bind(bar, 3);
+obj2 = new f();
+assertEquals(1, obj2.x);
+assertEquals(2, obj2.y);
+assertEquals(3, obj2.z);
+
+// Test instanceof obj2 is bar, not f.
+assertTrue(obj2 instanceof bar);
+assertFalse(obj2 instanceof f);
+