Narrow cases where Sparse/Smart versions of Array methods are used

Narrow cases where Sparse/Smart versions of Array methods are used

Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615, v8:3612, v8:3621
LOG=y
R=mstarzinger@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24855

[adamk, 2014-10-21 22:35:18]

adamk@chromium.org changed reviewers:
+ mstarzinger@chromium.org

[adamk, 2014-10-21 22:35:18]

Let me know if you'd rather I just roll the changes in
https://codereview.chromium.org/666883009 into this patch.

I've run this patch against all webkit, mozilla, and test262 tests in addition
to the usual tests in make check.

[Michael Starzinger, 2014-10-22 09:13:20]

LGTM. Please keep the CL that this depends on separate.

https://codereview.chromium.org/656423004/diff/1/test/mjsunit/array-shift2.js
File test/mjsunit/array-shift2.js (right):

https://codereview.chromium.org/656423004/diff/1/test/mjsunit/array-shift2.js...
test/mjsunit/array-shift2.js:16: assertEquals(["element 1","element 1"],
test(["0",,2]));
suggestion: It would be nice to also verify that a[0] is an own property whereas
a[1] is not. Or alternatively we could verify that the setter in the prototype
has been invoked.

[adamk, 2014-10-22 18:49:44]

https://codereview.chromium.org/656423004/diff/1/test/mjsunit/array-shift2.js
File test/mjsunit/array-shift2.js (right):

https://codereview.chromium.org/656423004/diff/1/test/mjsunit/array-shift2.js...
test/mjsunit/array-shift2.js:16: assertEquals(["element 1","element 1"],
test(["0",,2]));
On 2014/10/22 at 09:13:20, Michael Starzinger wrote:
> suggestion: It would be nice to also verify that a[0] is an own property
whereas a[1] is not. Or alternatively we could verify that the setter in the
prototype has been invoked.

Done (added hasOwnProperty tests).

[adamk, 2014-10-23 18:22:00]

Committed patchset #2 (id:20001) manually as 24855 (presubmit successful).

[adamk, 2014-10-23 20:03:10]

This is causing a few Blink test "failures" (actually tests that are now
passing). Tracking this in
https://code.google.com/p/chromium/issues/detail?id=426543, I'll land new
expectations so as to not harm the v8 roll.

[adamk, 2014-10-23 20:13:38]

On 2014/10/23 at 20:03:10, adamk wrote:
> This is causing a few Blink test "failures" (actually tests that are now
passing). Tracking this in
https://code.google.com/p/chromium/issues/detail?id=426543, I'll land new
expectations so as to not harm the v8 roll.

Landed test fixes in Blink:
https://src.chromium.org/viewvc/blink?revision=184299&view=revision