Revert "Update V8"

This reverts commit 1c4a5fcab76d1b769a4c0369d40dd0dd7c0e7495

Several of the qtdeclarative tests and examples are dying randomly with messages like this:
> 
> #
> # Fatal error in ../3rdparty/v8/src/objects-inl.h, line 2169
> # CHECK(object->IsJSFunction()) failed
> #
> 
> 
> ==== Stack trace ============================================
> 
> 
> ==== Details ================================================
> 
> ==== Key         ============================================
> 
> =====================
> 
> Aborted (core dumped)

Change-Id: Iebaa2497a6f6ef616ef4c3576c217d2a8a2c1ea5
Reviewed-by: Kent Hansen <kent.hansen@nokia.com>

1 files changed, 61 insertions, 0 deletions

diff --git a/src/v8/0016-Move-external-resource-to-the-last-hidden-field.patch b/src/v8/0016-Move-external-resource-to-the-last-hidden-field.patch
new file mode 100644
index 0000000000..b6dde1e024
--- /dev/null
+++ b/src/v8/0016-Move-external-resource-to-the-last-hidden-field.patch
@@ -0,0 +1,61 @@
+From 8f15248619bb3bf49473dc3ede8a4e631bd5d199 Mon Sep 17 00:00:00 2001
+From: Aaron Kennedy <aaron.kennedy@nokia.com>
+Date: Tue, 4 Oct 2011 14:22:54 +1000
+Subject: [PATCH 16/16] Move external resource to the last hidden field
+
+---
+ src/objects-inl.h |   10 +++++-----
+ 1 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/objects-inl.h b/src/objects-inl.h
+index 1765441..c02e037 100644
+--- a/src/objects-inl.h
++++ b/src/objects-inl.h
+@@ -1398,7 +1398,7 @@ int JSObject::GetInternalFieldCount() {
+ 
+ int JSObject::GetInternalFieldOffset(int index) {
+   ASSERT(index < GetInternalFieldCount() && index >= 0);
+-  return GetHeaderSize() + (kPointerSize * (index + map()->has_external_resource()?1:0));
++  return GetHeaderSize() + (kPointerSize * index);
+ }
+ 
+ 
+@@ -1407,7 +1407,7 @@ Object* JSObject::GetInternalField(int index) {
+   // Internal objects do follow immediately after the header, whereas in-object
+   // properties are at the end of the object. Therefore there is no need
+   // to adjust the index here.
+-  return READ_FIELD(this, GetHeaderSize() + (kPointerSize * (index + map()->has_external_resource()?1:0)));
++  return READ_FIELD(this, GetHeaderSize() + (kPointerSize * index));
+ }
+ 
+ 
+@@ -1416,7 +1416,7 @@ void JSObject::SetInternalField(int index, Object* value) {
+   // Internal objects do follow immediately after the header, whereas in-object
+   // properties are at the end of the object. Therefore there is no need
+   // to adjust the index here.
+-  int offset = GetHeaderSize() + (kPointerSize * (index + map()->has_external_resource()?1:0));
++  int offset = GetHeaderSize() + (kPointerSize * index);
+   WRITE_FIELD(this, offset, value);
+   WRITE_BARRIER(this, offset);
+ }
+@@ -1424,7 +1424,7 @@ void JSObject::SetInternalField(int index, Object* value) {
+ 
+ void JSObject::SetExternalResourceObject(Object *value) {
+   ASSERT(map()->has_external_resource());
+-  int offset = GetHeaderSize();
++  int offset = GetHeaderSize() + kPointerSize * GetInternalFieldCount();
+   WRITE_FIELD(this, offset, value);
+   WRITE_BARRIER(this, offset);
+ }
+@@ -1432,7 +1432,7 @@ void JSObject::SetExternalResourceObject(Object *value) {
+ 
+ Object *JSObject::GetExternalResourceObject() { 
+   if (map()->has_external_resource()) {
+-    return READ_FIELD(this, GetHeaderSize());
++    return READ_FIELD(this, GetHeaderSize() + kPointerSize * GetInternalFieldCount());
+   } else {
+     return GetHeap()->undefined_value();
+   }
+-- 
+1.7.4.4
+