Fix materialization of accessor frames with captured receivers

Fix materialization of accessor frames with captured receivers

I have fixed skipping of the receiver object to materialize captured
objects. This is done with a new DoTranslateSkip method.

We should consider unifying DoTranslateSkip, DoTranslateObject and
DoTranslateCommand as they do the almost the same thing - they only
differ in where they store the result.

The change also turns bunch of ASSERTs into CHECKs.

R=mstarzinger@chromium.org
BUG=359441
TEST=test/mjsunit/regress/regress-359441.js
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=20978

[Jarin, 2014-04-25 11:45:36]

On 2014/04/04 13:15:27, jarin wrote:

ping.

[Michael Starzinger, 2014-04-25 12:29:59]

LGTM (sorry, totally fell through the cracks).

https://codereview.chromium.org/225283006/diff/1/src/deoptimizer.h
File src/deoptimizer.h (right):

https://codereview.chromium.org/225283006/diff/1/src/deoptimizer.h#newcode338
src/deoptimizer.h:338: // Translate object, store the result into the given
frame slot.
nit: This does not only translate objects but also primitive values. Maybe the
three comments should read "Translate value/object, store [...]"

https://codereview.chromium.org/225283006/diff/1/src/deoptimizer.h#newcode345
src/deoptimizer.h:345: void DoTranslateSkip(TranslationIterator* iterator);
nit: Maybe we could call this DoTranslateObjectAndSkip?

[Jarin, 2014-04-25 12:58:24]

Committed patchset #3 manually as r20978 (presubmit successful).