[turbofan] Turn JSTypedLowering into an AdvancedReducer.

This in turn allows usage of AdvancedReducer::ReplaceWithValue which
has access to the underlying graph reducer. It will allow us to deal
with exception continuations correctly.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1134303003

Cr-Commit-Position: refs/heads/master@{#28468}

X87: Now that vector ics are established for load, keyed load and call ics, let's remove dead code behind the flag.

port 323ced9e272e234d19db13d407b5bb9da266681d (r28422).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1142713007

Cr-Commit-Position: refs/heads/master@{#28467}

[turbofan] Carefully update frame states during inlining.

During inlining we should pay attention to only rewire the outer frame
states of the inlinee, but leave any inner frame states of the inlinee
untouched.  Otherwise we might run into trouble once we start caching
graphs, or do getter/setter inlining.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134973006

Cr-Commit-Position: refs/heads/master@{#28466}

[turbofan] Support vector IC feedback in the JSTypeFeedbackTable.

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133113004

Cr-Commit-Position: refs/heads/master@{#28465}

Revert of [strong] Object literals create strong objects (patchset #4 id:60001 of https://codereview.chromium.org/1134333005/)

Reason for revert:
[Sheriff] Segmentation fault on arm64 with nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%201/builds/1990

Original issue's description:
> [strong] Object literals create strong objects
>
> R=dslomov@chromium.org
> BUG=v8:3956
> LOG=N
>
> Committed: https://crrev.com/fe6598cffb82ec4180dcc2e2310e77d07a803f96
> Cr-Commit-Position: refs/heads/master@{#28444}

TBR=dslomov@chromium.org,arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1135493006

Cr-Commit-Position: refs/heads/master@{#28464}

Fix harmless HGraph verification failure after hoisting inlined bounds checks

BUG=chromium:487608
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1133343003

Cr-Commit-Position: refs/heads/master@{#28463}

Use USE_SIMULATOR when appropriate.

Review URL: https://codereview.chromium.org/1142043003

Cr-Commit-Position: refs/heads/master@{#28462}

Do not clear stepping after DebugEvaluate.

Clearing stepping was originally introduced in http://codereview.chromium.org/7889039
But DebugEvaluate now also uses a DisableBreak scope, which makes sure we don't step
inside the evaluated code.

R=yurys@chromium.org
BUG=chromium:467180
LOG=N

Review URL: https://codereview.chromium.org/1129363003

Cr-Commit-Position: refs/heads/master@{#28461}

Update V8 DEPS.

Rolling v8/tools/clang to a01f3daa088378f5ae90e37e5673d963b63d05dc

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1136643007

Cr-Commit-Position: refs/heads/master@{#28460}

[V8] Added Script::is_opaque flag for embedders

When the page is controlled by a ServiceWorker, the ServiceWorker can return an opaque (non-CORS cross origin) resource response.
We need to treat the messages from such script resource as opaque.

Committed: https://crrev.com/7a599c5e1242d3c5ab7515ee149623da90ae69ec
Cr-Commit-Position: refs/heads/master@{#28445}

Review URL: https://codereview.chromium.org/1140673002

Cr-Commit-Position: refs/heads/master@{#28459}

Reapply "Resolve references to "this" the same way as normal variables""

This reapplies https://codereview.chromium.org/1136073002, along with
the followups:

  Remove Scope::scope_uses_this_ flag
  https://codereview.chromium.org/1128963005

and

  PPC: Resolve references to "this" the same way as normal variables
  https://codereview.chromium.org/1134073003

R=yangguo@chromium.org, rossberg@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1136883006

Cr-Commit-Position: refs/heads/master@{#28458}

[destructuring] More tests for object literal pattern

R=arv@chromium.org,rossberg@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1139773005

Cr-Commit-Position: refs/heads/master@{#28457}

Add TypedArray.from method

This function creates a new way to make TypedArrays based on existing
iterable or Array-like objects, analogous to Array.from. The patch
implements the function and adds tests.

R=arv@chromium.org
BUG=v8:3578
LOG=Y

Review URL: https://codereview.chromium.org/1132163011

Cr-Commit-Position: refs/heads/master@{#28456}

ARM64: Propagate notification about aborted compilation from RegExpEngine to MacroAssembler.

BUG=chromium:489290
LOG=Y

Review URL: https://codereview.chromium.org/1145653004

Cr-Commit-Position: refs/heads/master@{#28455}

[parser] report SyntaxError if rest parameter used in Setter MethodDefinition

BUG=v8:4107, v8:2159
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1141223002

Cr-Commit-Position: refs/heads/master@{#28454}

Fixed SEGV that could happen if an exception is thrown during bootstrapping.

BUG=chromium:487974
LOG=N

Review URL: https://codereview.chromium.org/1145703002

Cr-Commit-Position: refs/heads/master@{#28453}

[turbofan] Fix Node::TrimInputCount() followed by Node::AppendInput() bug.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1132353004

Cr-Commit-Position: refs/heads/master@{#28452}

[test] Refactoring: Remove code duplication in perf runner.

BUG=484208
LOG=n
TBR=kjellander@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1139833003

Cr-Commit-Position: refs/heads/master@{#28451}

Update change log to match roll branch.

NOTRY=true

Review URL: https://codereview.chromium.org/1140603005

Cr-Commit-Position: refs/heads/master@{#28450}

Revert of [V8] Added Script::is_opaque flag for embedders (patchset #5 id:80001 of https://codereview.chromium.org/1140673002/)

Reason for revert:
[Sheriff] Breaks chromium win compilation:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/96

Original issue's description:
> [V8] Added Script::is_opaque flag for embedders
>
> When the page is controlled by a ServiceWorker, the ServiceWorker can return an opaque (non-CORS cross origin) resource response.
> We need to treat the messages from such script resource as opaque.
>
> Committed: https://crrev.com/7a599c5e1242d3c5ab7515ee149623da90ae69ec
> Cr-Commit-Position: refs/heads/master@{#28445}

TBR=mkwst@chromium.org,jochen@chromium.org,yangguo@chromium.org,horo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1135343005

Cr-Commit-Position: refs/heads/master@{#28449}

[release-tools] Add more jobs to clusterfuzz check.

This will send automatic email notifications about reliable
failures from the respective jobs.

NOTRY=true

Review URL: https://codereview.chromium.org/1147713002

Cr-Commit-Position: refs/heads/master@{#28448}

[strong] Fix super in strong classes

The functions of strong classes are born non extensible. But, when
the class is created we need to add an own private symbol representing
the [[HomeObject]] slot in the spec.

Like for the hidden_string property, we allow adding private own
symbols to non extensible objects.

BUG=v8:4077
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1138603003

Cr-Commit-Position: refs/heads/master@{#28447}

Add --download-data-only option to run-test.py

The simd.js benchmarks reside in the same repository
that holds the compliance tests.

Adding an option to run-test.py to download test data
and exit, so that a recipe to run the simd.js
benchmarks can call run-test.py with this option
to fetch the test data.

BUG=https://code.google.com/p/v8/issues/detail?id=4124
LOG=N
TEST=manual verification it works.
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1140353002

Cr-Commit-Position: refs/heads/master@{#28446}

[V8] Added Script::is_opaque flag for embedders

When the page is controlled by a ServiceWorker, the ServiceWorker can return an opaque (non-CORS cross origin) resource response.
We need to treat the messages from such script resource as opaque.

Review URL: https://codereview.chromium.org/1140673002

Cr-Commit-Position: refs/heads/master@{#28445}

[strong] Object literals create strong objects

R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1134333005

Cr-Commit-Position: refs/heads/master@{#28444}

Remove undefined-check from GetElementWithReceiver

BUG=

Review URL: https://codereview.chromium.org/1145693002

Cr-Commit-Position: refs/heads/master@{#28443}

Reland "Mark internal AccessorInfo properties as 'special data properties'"

This reverts commit ac5336baca8c1ee45be0157aa1d4f9a178d75bb6.

BUG=

Review URL: https://codereview.chromium.org/1138483005

Cr-Commit-Position: refs/heads/master@{#28442}

[turbofan] JSTypeFeedbackSpecializer is now an AdvancedReducer.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1136413002

Cr-Commit-Position: refs/heads/master@{#28441}

MIPS: Fix bogus line in assembler test.

TEST=cctest/test-assembler-mips/MIPS11
BUG=

Review URL: https://codereview.chromium.org/1133663007

Cr-Commit-Position: refs/heads/master@{#28440}

Migrate error messages, part 12.

Review URL: https://codereview.chromium.org/1130133003

Cr-Commit-Position: refs/heads/master@{#28439}

Update V8 DEPS.

Rolling v8/tools/clang to 26185eb8de21f4755350a246d30bca8cd5a12deb

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1132373004

Cr-Commit-Position: refs/heads/master@{#28438}

Revert of Mark internal AccessorInfo properties as "special data properties" (patchset #2 id:20001 of https://codereview.chromium.org/1123163005/)

Reason for revert:
[Sheriff] Blocks current roll:
https://codereview.chromium.org/1124403007/

Bisection (https://codereview.chromium.org/1142753002/) points to this CL.

Original issue's description:
> Mark internal AccessorInfo properties as "special data properties" to ensure correct strict-mode handling.
>
> BUG=
>
> Committed: https://crrev.com/188297160d2b82a4e2a206ebbddfc21dd99a9d8d
> Cr-Commit-Position: refs/heads/master@{#28369}

TBR=rossberg@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1142763002

Cr-Commit-Position: refs/heads/master@{#28437}

Revert of Debugger: preserve stepping state after evaluating breakpoint condition. (patchset #1 id:1 of https://codereview.chromium.org/1132643004/)

Reason for revert:
[Sheriff] This breaks TSAN (makes some tests marked as flaky permanently fail):
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/3882

Original issue's description:
> Debugger: preserve stepping state after evaluating breakpoint condition.
>
> R=ulan@chromium.org, yurys@chromium.org
> BUG=chromium:467180
> LOG=N

TBR=ulan@chromium.org,yurys@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:467180

Review URL: https://codereview.chromium.org/1130123007

Cr-Commit-Position: refs/heads/master@{#28436}

Update version to 4.5

BUG=
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1123393006

Cr-Commit-Position: refs/heads/master@{#28435}

Update V8 DEPS.

Rolling v8/tools/clang to ec43def7c912c4a6bfadaf9e500bfb05da263f6f

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1139293002

Cr-Commit-Position: refs/heads/master@{#28434}

Update V8 DEPS.

Rolling v8/third_party/icu to 5788e2736b3bc642994b6351a6096124895afa01

Rolling v8/tools/clang to e11ef3ee3eecde207b8a38916b34fde40352f466

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1138003006

Cr-Commit-Position: refs/heads/master@{#28433}

Debugger: preserve stepping state after evaluating breakpoint condition.

R=ulan@chromium.org, yurys@chromium.org
BUG=chromium:467180
LOG=N

Review URL: https://codereview.chromium.org/1132643004

Cr-Commit-Position: refs/heads/master@{#28432}

PPC: Now that vector ics are established for load, keyed load and call ics, let's remove dead code behind the flag.

Port 323ced9e272e234d19db13d407b5bb9da266681d

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1132513007

Cr-Commit-Position: refs/heads/master@{#28431}

Clean-up aligned allocation logic.

BUG=

Review URL: https://codereview.chromium.org/1138643005

Cr-Commit-Position: refs/heads/master@{#28430}

Shrink active semi-space and uncommit other semi-space only in idle memory mode.

BUG=chromium:483147
LOG=n

Review URL: https://codereview.chromium.org/1140693003

Cr-Commit-Position: refs/heads/master@{#28429}

Make sure that idle scavenges are just performed when enough objects are allocated in new space.

BUG=

Review URL: https://codereview.chromium.org/1138643003

Cr-Commit-Position: refs/heads/master@{#28428}

Fix V8 extras js2c pipeline

570fca61 introduced a regression that caused minification etc. to be
applied to V8 extras.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1125103003

Cr-Commit-Position: refs/heads/master@{#28427}

[es6] Iterators and generators should "extend" %IteratorPrototype%

All the builtin iterators as well as the generator objects have an
object called %IteratorPrototype% in the spec between them and
%ObjectPrototype%.

BUG=v8:3568
LOG=N

Review URL: https://codereview.chromium.org/1128233008

Cr-Commit-Position: refs/heads/master@{#28426}

Remove release-mode assert that has out-stayed its welcome

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1127333004

Cr-Commit-Position: refs/heads/master@{#28425}

Add regression test for resolving "this" in debug evaluate.

R=hablich@chromium.org
BUG=chromium:487289
LOG=N

Review URL: https://codereview.chromium.org/1137293002

Cr-Commit-Position: refs/heads/master@{#28424}

Migrate error messages, part 11.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1140053002

Cr-Commit-Position: refs/heads/master@{#28423}

Now that vector ics are established for load, keyed load and call ics, let's remove dead code behind the flag.

BUG=

Review URL: https://codereview.chromium.org/1129853002

Cr-Commit-Position: refs/heads/master@{#28422}

Bug: Runtime_GrowArrayElements provoked unnecessary lazy deopt.

Unnecessary, and unhandled as well.

BUG=488398
R=jarin@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1141163004

Cr-Commit-Position: refs/heads/master@{#28421}

Store fewer arrays in the context snapshot.

This slightly reduces the initial context size.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1146523002

Cr-Commit-Position: refs/heads/master@{#28420}

[turbofan] Pass closure as node to FrameState.

First step towards support for inlining based on SharedFunctionInfo
instead of JSFunction.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134713004

Cr-Commit-Position: refs/heads/master@{#28419}

Map::ReconfigureProperty() should mark map as unstable when there is an element kind transition somewhere in the middle of the transition tree.

BUG=chromium:485548
LOG=N

Review URL: https://codereview.chromium.org/1128043005

Cr-Commit-Position: refs/heads/master@{#28418}

[destructuring] Adapting PatternRewriter to work in C-style for-statements.

BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1128043006

Cr-Commit-Position: refs/heads/master@{#28417}

When context disposal rate is high and we cannot perform a full GC, we do nothing until the context disposal rate becomes lower.

BUG=chromium:473351
LOG=n

Review URL: https://codereview.chromium.org/1118303004

Cr-Commit-Position: refs/heads/master@{#28416}

Reland "Prevent stack overflow in the serializer/deserializer."

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1124403006

Cr-Commit-Position: refs/heads/master@{#28415}

Remove static logging of memory allocations

We want to move to a world where there's no Isolate::Current but we
always knows which isolate we're in. There's no way we can teach this
info to the C++ allocator.

BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1128023005

Cr-Commit-Position: refs/heads/master@{#28414}

Fix Heap::AllocateFillerObject() to use double alignment param.

This is called from Runtime, and was dropping the requested alignment
for doubles. Needed for upcoming MIPS CL to remove some more
workarounds for load/store doubles.

BUG=

Review URL: https://codereview.chromium.org/1131123003

Cr-Commit-Position: refs/heads/master@{#28413}

ARM64: Enable shorten-64-to-32 warning

Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1131573006

Cr-Commit-Position: refs/heads/master@{#28412}

Update V8 DEPS.

Rolling v8/tools/clang to 50042056ee1589e57bdb6ecba4609a7da51c7ec4

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1136353003

Cr-Commit-Position: refs/heads/master@{#28411}

Remove Isolate::Current() call from jsregexp

BUG=none
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1143583002

Cr-Commit-Position: refs/heads/master@{#28410}

Test that TypedArray methods don't read length

ES6 specifies that methods on TypedArrays reference an internal length
slot, rather than their length property. This patch tests that for the
TypedArray methods that exist currently.

R=arv@chromium.org
BUG=v8:3578
LOG=Y

Review URL: https://codereview.chromium.org/1130413010

Cr-Commit-Position: refs/heads/master@{#28409}

Remove unnecessary Isolate::Current calls from hydrogen-instructions

BUG=none
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1144523004

Cr-Commit-Position: refs/heads/master@{#28408}

Fix deprecation declarations in headers

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1127963005

Cr-Commit-Position: refs/heads/master@{#28407}

Remove unnecessary call to Isolate::Current in parser-shell

R=vogelheim@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1123203003

Cr-Commit-Position: refs/heads/master@{#28406}

[es6] support spread-calling Super-accessing properties

BUG=v8:4105, v8:3018
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1132933003

Cr-Commit-Position: refs/heads/master@{#28405}

Revert of MIPS: Add float instructions and test coverage, part one

Reason for revert:
Simulator test failures in RunChangeFloat64ToInt.., RunChangeTaggedToInt32,
div-mul-minus-one

Original issue's description:

> Implement assembler, disassembler tests for all instructions for mips32
> and mips64. Additionally, add missing single precision float instructions
> for r2 and r6 architecture variants in assembler, simulator and disassembler
> with corresponding tests.

BUG=

Review URL: https://codereview.chromium.org/1143473003

Cr-Commit-Position: refs/heads/master@{#28404}

Revert of Prevent stack overflow in the serializer/deserializer. (patchset #6 id:100001 of https://codereview.chromium.org/1125073004/)

Reason for revert:
[Sheriff] Breaks msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2266

Original issue's description:
> Prevent stack overflow in the serializer/deserializer.
>
> We keep an eye on the recursion depth. Once it exceeds a limit, we serialize
> only the object header and size, but defer serializing the object body for
> after we have unwound the stack.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/36b4a498d6614243454d5a182e4946b0dad24f0a
> Cr-Commit-Position: refs/heads/master@{#28385}

TBR=mvstanton@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1139113002

Cr-Commit-Position: refs/heads/master@{#28403}

MIPS: Add float instructions and test coverage, part one

Implement assembler, disassembler tests for all instructions for mips32 and mips64. Additionally, add missing single precision float instructions for r2 and r6 architecture variants in assembler, simulator and disassembler with corresponding tests.

Review URL: https://codereview.chromium.org/1119203003

Cr-Commit-Position: refs/heads/master@{#28402}

Revert "X87: Resolve references to "this" the same way as normal variables"

This reverts commit 6eea252463648d81cf3ae128e6f0d5f815a108bb.

revert reason:
   original patch is reverted.

BUG=

Review URL: https://codereview.chromium.org/1130853007

Cr-Commit-Position: refs/heads/master@{#28401}

Update V8 DEPS.

Rolling v8/testing/gtest to 23574bf2333f834ff665f894c97bef8a5b33a0a9

Rolling v8/tools/clang to 17e168207560f2dfdf95e50c5eb79e6d3ac1eaf6

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1136913007

Cr-Commit-Position: refs/heads/master@{#28400}

[turbofan] Treat uninitialized source positions as unknown.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1109763002

Cr-Commit-Position: refs/heads/master@{#28399}

[turbofan] Reenable feedback for LoadNamed.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1140943003

Cr-Commit-Position: refs/heads/master@{#28398}

Rely on ExpressionClassifier to match valid arrow function formals

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1123383005

Cr-Commit-Position: refs/heads/master@{#28397}

[strong] Introduce strong bit

Only set on strong functions so far to test basic operation.

R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1138243002

Cr-Commit-Position: refs/heads/master@{#28396}

Revert "Resolve references to "this" the same way as normal variables"

... and the following two
"PPC: Resolve references to "this" the same way as normal variables"
"Remove Scope::scope_uses_this_ flag"

R=hablich@chromium.org
BUG=chromium:487289
LOG=N

Review URL: https://codereview.chromium.org/1134003003

Cr-Commit-Position: refs/heads/master@{#28395}

[turbofan] Turn off type feedback in turbo mode until StoreNamed issue is resolved.

TBR=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1130073006

Cr-Commit-Position: refs/heads/master@{#28394}

[turbofan] Lower more number operations to integer operations.

If the typer was able to prove that a NumberAdd/Sub/Mul/Div/Mod always
produces a Signed32/Unsigned32 value, and the inputs are
Signed32/Unsigned32, we can lower the node to the corresponding integer
operation instead, no matter what the uses are.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140933002

Cr-Commit-Position: refs/heads/master@{#28393}

[turbofan] Add FrameStates before all property accesses.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133303006

Cr-Commit-Position: refs/heads/master@{#28392}

Use ExpressionClassifier to identify valid arrow function formals

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1138153003

Cr-Commit-Position: refs/heads/master@{#28391}

X87: Resolve references to "this" the same way as normal variables

port bd56d279b612f92d2d1d25f92d32fe7f42a455ca (R28340).

original commit message:

    Make the parser handle references to "this" as unresolved variables, so the
    same logic as for the rest of function parameters is used for the receiver.
    Minor additions to the code generation handle copying the receiver to the
    context, along with the rest of the function parameters.

    Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=

Review URL: https://codereview.chromium.org/1136953010

Cr-Commit-Position: refs/heads/master@{#28390}

[turbofan] Use frame state before for shift operations as well.

This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}

X87: New hydrogen instruction to reduce cost of growing an array on keyed stores.

port 3bce9c3afbe792167a54db49b16679289e0aea8f (r28359).

original commit message:

    HMaybeGrowElements moves the situation where you actually have to grow
    into deferred code. This means crankshaft doesn't have to spill registers
    just to make the bounds comparison to see if it'll need to grow or not.

    It makes the growing case a bit more expensive, but reduces the cost of
    the general case.

BUG=

Review URL: https://codereview.chromium.org/1124093008

Cr-Commit-Position: refs/heads/master@{#28388}

X87: [strong] Check arity of functions

port 3226e980200035f37c86fef4b11fb307e17764a2 (28346).

original commit message:

    [strong] Check arity of functions

    In strong mode it is an error to call a function with too few
    arguments.

    This is enforced inside the ArgumentsAdaptorTrampoline.

    This does not yet handle rest parameter

BUG=

Review URL: https://codereview.chromium.org/1139913007

Cr-Commit-Position: refs/heads/master@{#28387}

X87: Add a MathFloor stub generated with TurboFan

port  abc35080b33cc31e47b9913e64ac99ec687c6b65 (r28339)

original commit message:

    This stub will be used as the basis of a Math.floor-specific CallIC to
    detect and track calls to floor that return -0.

    Along the way:
    - Create a TurboFanCodeStub super class from which the StringLength and
    MathRound TF stubs derive.
    - Fix the ugly hack that passes the first stub parameter as the "this"
    pointer in the the TF-compiled JS function.
    - Fix bugs in the ia32/x64 disassembler.

BUG=

Review URL: https://codereview.chromium.org/1134323002

Cr-Commit-Position: refs/heads/master@{#28386}

Prevent stack overflow in the serializer/deserializer.

We keep an eye on the recursion depth. Once it exceeds a limit, we serialize
only the object header and size, but defer serializing the object body for
after we have unwound the stack.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1125073004

Cr-Commit-Position: refs/heads/master@{#28385}

[test] Make perf runner able to pass extra flags to d8.

TEST=tools/run_perf.py --arch x64 --extra-flags="--turbo --turbo-verify-allocation --turbo-greedy-regalloc" /path/to/SunSpider.json
BUG=484208
LOG=n
TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1128933007

Cr-Commit-Position: refs/heads/master@{#28384}

[turbofan] Add frame state before JavaScript comparisons.

Use these check points to optimize comparisons where we already know
that one side cannot be a String (or turn into a string via
ToPrimitive).

Also remove bunch of useless DoNotCrash tests for the scheduler that are
painful to maintain and add almost no value.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140583004

Cr-Commit-Position: refs/heads/master@{#28383}

Implement %TypedArray%.{fill,find,findIndex}

This patch adds three methods to TypedArrays which are already
implemented for arrays. The implementations are made by calling
out to the underlying code used by Arrays.

R=adamk@chromium.org
BUG=v8:3578
LOG=Y

Review URL: https://codereview.chromium.org/1136663005

Cr-Commit-Position: refs/heads/master@{#28382}

TypedArray.prototype.copyWithin method

This patch adds the copyWithin method to TypedArrays. For the first
pass, the internals of Array.copyWithin are used. Eventually, a more
efficient form based on memcpy could be used instead.

BUG=v8:3578
LOG=Y
R=adamk@chromium.org, arv@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/1131113002

Cr-Commit-Position: refs/heads/master@{#28381}

Fix test formatting

TBR=arv@chromium.org

Review URL: https://codereview.chromium.org/1129713004

Cr-Commit-Position: refs/heads/master@{#28380}

[strong] Add more function arity tests

This is a follow up to https://codereview.chromium.org/1115263004/

BUG=v8:3956
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1141603002

Cr-Commit-Position: refs/heads/master@{#28379}

Make transition to reduce memory mode more conservative in idle time handler.

BUG=chromium:486005
LOG=NO

Review URL: https://codereview.chromium.org/1131943004

Cr-Commit-Position: refs/heads/master@{#28378}

Fix the behavior of 'super.foo' assignment when receiver is not an object.

R=arv@chromium.org,verwaest@chromium.org
BUG=v8:4097
LOG=N

Review URL: https://codereview.chromium.org/1132203005

Cr-Commit-Position: refs/heads/master@{#28377}

Make LoadFastElementStub a HandlerStub.

BUG=

Review URL: https://codereview.chromium.org/1132493006

Cr-Commit-Position: refs/heads/master@{#28376}

PPC: Fix '[strong] Disallow implicit conversions for comparison'

Do not trash type register in kIsNotStringMask test.

R=conradw@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1124333013

Cr-Commit-Position: refs/heads/master@{#28375}

PPC: Fix '[strong] Disallow implicit conversions for comparison'

Fix build break.

R=conradw@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1130603004

Cr-Commit-Position: refs/heads/master@{#28374}

Get more debugging data when crashing in Deoptimizer::GetOutputInfo.

BUG=

Review URL: https://codereview.chromium.org/1138493004

Cr-Commit-Position: refs/heads/master@{#28373}

PPC: New hydrogen instruction to reduce cost of growing an array on keyed stores.

Port 3bce9c3afbe792167a54db49b16679289e0aea8f

Original commit message:
HMaybeGrowElements moves the situation where you actually have to grow
into deferred code. This means crankshaft doesn't have to spill registers
just to make the bounds comparison to see if it'll need to grow or not.

It makes the growing case a bit more expensive, but reduces the cost of
the general case.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1132743004

Cr-Commit-Position: refs/heads/master@{#28372}

Provide accessor for object internal properties that doesn't require debugger to be active

Some of the DevTools' clients need to inspect JS objects without enabling debugger. This CL allows to inspect object's internal properties without enabling debugger and instantiating debug context.

Note that now debug context can be created lazily if v8::Debug::GetDebugContext is called when there is no debug listener. This is fragile and has already resulted in some subtle error. I'm going to fix that in a separate CL.

BUG=chromium:481845
LOG=Y

Review URL: https://codereview.chromium.org/1134193002

Cr-Commit-Position: refs/heads/master@{#28371}

[strong] Disallow implicit conversions for comparison

Implements the strong mode proposal's restrictions on implicit conversions
for the binary >, >=, <, and <= operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1130283002

Cr-Commit-Position: refs/heads/master@{#28370}

Mark internal AccessorInfo properties as "special data properties" to ensure correct strict-mode handling.

BUG=

Review URL: https://codereview.chromium.org/1123163005

Cr-Commit-Position: refs/heads/master@{#28369}