Merge bleeding edge up to 9192 into the GC branch.

src/deoptimizer.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 319 matching lines @@
  public:
   FrameDescription(uint32_t frame_size,
                    JSFunction* function);
 
   void* operator new(size_t size, uint32_t frame_size) {
     // Subtracts kPointerSize, as the member frame_content_ already supplies
     // the first element of the area to store the frame.
     return malloc(size + frame_size - kPointerSize);
   }
 
+  void operator delete(void* pointer, uint32_t frame_size) {
+    free(pointer);
+  }
+
   void operator delete(void* description) {
     free(description);
   }
 
   uint32_t GetFrameSize() const {
     ASSERT(static_cast<uint32_t>(frame_size_) == frame_size_);
     return static_cast<uint32_t>(frame_size_);
   }
 
   JSFunction* GetFunction() const { return function_; }
@@ skipping 364 matching lines @@
   Object** parameters_;
   Object** expression_stack_;
 
   friend class Deoptimizer;
 };
 #endif
 
 } }  // namespace v8::internal
 
 #endif  // V8_DEOPTIMIZER_H_