Revert of Make it possible to hoist the neutering check for TA property accesses (patchset #1 id:1 of https://codereview.chromium.org/1107993002/)

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3403

Original issue's description:
> Make it possible to hoist the neutering check for TA property accesses
>
> Also correctly set up the dependency between propoerty and elements
> accesses and the checks
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/6a62e321381e1a212983804c4197068e842b240f
> Cr-Commit-Position: refs/heads/master@{#28087}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1108823003

Cr-Commit-Position: refs/heads/master@{#28088}

Make it possible to hoist the neutering check for TA property accesses

Also correctly set up the dependency between propoerty and elements
accesses and the checks

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107993002

Cr-Commit-Position: refs/heads/master@{#28087}

Revert of Preprocess structured stack trace on GC to get rid of code reference. (patchset #5 id:80001 of https://codereview.chromium.org/1103843002/)

Reason for revert:
Broke GCStress

Original issue's description:
> Preprocess structured stack trace on GC to get rid of code reference.
>
> R=verwaest@chromium.org
> BUG=v8:2340
> LOG=N
>
> Committed: https://crrev.com/462ffa1dfa0ab3a851ea0294470d1ed7ed12dd56
> Cr-Commit-Position: refs/heads/master@{#28085}

TBR=verwaest@chromium.org,ulan@chromium.org,hpayer@chromium.org,yurys@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2340

Review URL: https://codereview.chromium.org/1102383002

Cr-Commit-Position: refs/heads/master@{#28086}

Preprocess structured stack trace on GC to get rid of code reference.

R=verwaest@chromium.org
BUG=v8:2340
LOG=N

Review URL: https://codereview.chromium.org/1103843002

Cr-Commit-Position: refs/heads/master@{#28085}

Use ExpressionClassifier for bindings.

Just a refactoring, real pattern parsing comes in a later CL.

R=rossberg@chromium.org,marja@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1066933005

Cr-Commit-Position: refs/heads/master@{#28084}

Remove kOsrCompileFailed bailout.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1105133002

Cr-Commit-Position: refs/heads/master@{#28083}

Do more to avoid last-resort stop-the-world GC

BUG=chromium:481433
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1104113002

Cr-Commit-Position: refs/heads/master@{#28082}

Reland: track global accesses to constant types

R=verwaest@chromium.org
BUG=468620
LOG=N

Review URL: https://codereview.chromium.org/1102543002

Cr-Commit-Position: refs/heads/master@{#28081}

Changing Size to SizeOfObjects in GetHeapSpaceStatistics api.

This CL changes GetHeapSpaceStatistics api to return SizeOfObjects()
instead of Size(). SizeOfObjects is the required field and is
consistent with GetHeapStatistics api.

BUG=476013
LOG=N

Review URL: https://codereview.chromium.org/1095393005

Cr-Commit-Position: refs/heads/master@{#28080}

Revert of deprecate non-phantom weak callbacks (patchset #1 id:1 of https://codereview.chromium.org/1103173002/)

Reason for revert:
[Sheriff] Fails compilation on chromium android:
http://build.chromium.org/p/client.v8/builders/Android%20Builder/builds/4131

Is the chromium version our builder used maybe too old (it uses lkcr)? In that case please reland as soon as it's up-to-date.

Original issue's description:
> deprecate non-phantom weak callbacks
>
> BUG=
>
> Committed: https://crrev.com/39c31da2142ab0fca9dae279b9e59cd4951a1982
> Cr-Commit-Position: refs/heads/master@{#28077}

TBR=jochen@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1104163002

Cr-Commit-Position: refs/heads/master@{#28079}

Reland [test] Make msan work for v8 stand-alone. (patchset #1 id:1 of https://codereview.chromium.org/1104073002/)

Reason for revert:
Reland after switching bot to ninja.

Original issue's description:
> Revert of [test] Make msan work for v8 stand-alone. (patchset #6 id:100001 of https://codereview.chromium.org/802583003/)
>
> Reason for revert:
> Compile failures: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2047
>
> Original issue's description:
> > [test] Make msan work for v8 stand-alone.
> >
> > The msan configuration can be used in combination with
> > v8_use_snapshot=false.
> >
> > BUG=chromium:425187
> > LOG=n
> >
> > Committed: https://crrev.com/a65ef0d53fc28b0908f228938c6d84effa83c596
> > Cr-Commit-Position: refs/heads/master@{#28064}
>
> TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:425187
>
> Committed: https://crrev.com/f69a48696ec3ec0ea1169a41b4c84fb36b059968
> Cr-Commit-Position: refs/heads/master@{#28068}

TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:425187

Review URL: https://codereview.chromium.org/1102323002

Cr-Commit-Position: refs/heads/master@{#28078}

deprecate non-phantom weak callbacks

BUG=

Review URL: https://codereview.chromium.org/1103173002

Cr-Commit-Position: refs/heads/master@{#28077}

Reland "Lazily register prototype users..."

...when handing out validity cells to handlers; because invalidating said cells is
the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after
the recently introduced compaction support.

This reverts commit 968715c653b6337252a05a0224a7a93fab3b0866.

Original review: https://codereview.chromium.org/1104813004/

Review URL: https://codereview.chromium.org/1110513002

Cr-Commit-Position: refs/heads/master@{#28076}

[turbofan] make register hinting explicit

- instead of committing operands early to resolve hints, hold the hint register data on the UsePosition
- allow hints to be rolled back efficiently as needed by GreedyAllocator
- some small drive by fixes

BUG=

Review URL: https://codereview.chromium.org/1103533002

Cr-Commit-Position: refs/heads/master@{#28075}

Wrap messages implementation in a function.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1106633002

Cr-Commit-Position: refs/heads/master@{#28074}

[turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1110503002

Cr-Commit-Position: refs/heads/master@{#28073}

Eagerly declare eval scopes, even for sloppy scopes

R=mstarzinger@chromium.org
LOG=N
BUG=N

Review URL: https://codereview.chromium.org/1110473003

Cr-Commit-Position: refs/heads/master@{#28072}

Debugger: clean up debug events.

The debug event BreakForCommand is now deprecated, as it cannot happen any longer.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1089893002

Cr-Commit-Position: refs/heads/master@{#28071}

[release-tools] Return no hash if version is not available.

BUG=

Review URL: https://codereview.chromium.org/1105023002

Cr-Commit-Position: refs/heads/master@{#28070}

Disable test-run-jsexceptions for nosnap builds.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1105043002

Cr-Commit-Position: refs/heads/master@{#28069}

Revert of [test] Make msan work for v8 stand-alone. (patchset #6 id:100001 of https://codereview.chromium.org/802583003/)

Reason for revert:
Compile failures: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2047

Original issue's description:
> [test] Make msan work for v8 stand-alone.
>
> The msan configuration can be used in combination with
> v8_use_snapshot=false.
>
> BUG=chromium:425187
> LOG=n
>
> Committed: https://crrev.com/a65ef0d53fc28b0908f228938c6d84effa83c596
> Cr-Commit-Position: refs/heads/master@{#28064}

TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:425187

Review URL: https://codereview.chromium.org/1104073002

Cr-Commit-Position: refs/heads/master@{#28068}

[turbofan] Fix win64 after r28066.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1106963002

Cr-Commit-Position: refs/heads/master@{#28067}

[turbofan] Add language mode to JSCallFunction operator.

Also do some drive-by-cleanup to the unittests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1107883002

Cr-Commit-Position: refs/heads/master@{#28066}

Handlify ExecutableAccessorInfo::ClearSetter since it allocates.

BUG=chromium:478556
LOG=n

Review URL: https://codereview.chromium.org/1107853002

Cr-Commit-Position: refs/heads/master@{#28065}

[test] Make msan work for v8 stand-alone.

The msan configuration can be used in combination with
v8_use_snapshot=false.

BUG=chromium:425187
LOG=n

Review URL: https://codereview.chromium.org/802583003

Cr-Commit-Position: refs/heads/master@{#28064}

Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer. (patchset #10 id:180001 of https://codereview.chromium.org/1063513003/)

Reason for revert:
[sheriff] Breaks nosnap debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/156

Original issue's description:
> [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
>
> Uses lazy deoptimization and code dependencies to introduce loads
> from property cells and also to promote globals to constants.
>
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://crrev.com/aae4a62d07e839455b1d0ad4fa512cc5d48a1a68
> Cr-Commit-Position: refs/heads/master@{#28057}

TBR=mstarzinger@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1084533003

Cr-Commit-Position: refs/heads/master@{#28063}

[turbofan] Introduce explicit JSCreateLiteral[Array|Object].

This uses explicit operators instead of intrinsic runtime calls to
create literals froms boilerplates. It allows for easier access of
static parameters and syncs it with other allocating operators.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1104453006

Cr-Commit-Position: refs/heads/master@{#28062}

[turbofan] Sanitize language mode for JSStoreProperty operator.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1109733002

Cr-Commit-Position: refs/heads/master@{#28061}

Reland "Remove the weak list of views from array buffers"

Original description:
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107843002

Cr-Commit-Position: refs/heads/master@{#28060}

[turbofan] Sanitize language mode for javascript operators.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1084243005

Cr-Commit-Position: refs/heads/master@{#28059}

[turbofan] Use FastNewClosureStub if possible.

This introduces a JSCreateClosure operator which can be lowered by the
typed pipeline to the aforementioned stub. It also allows for further
optimizations of closure creation.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1105513002

Cr-Commit-Position: refs/heads/master@{#28058}

[turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.

Uses lazy deoptimization and code dependencies to introduce loads
from property cells and also to promote globals to constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1063513003

Cr-Commit-Position: refs/heads/master@{#28057}

Don't MISS if you read the hole from certain FastHoley arrays.

If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}

Fix stack layout of full code arm64 for object literal.

BUG=

Review URL: https://codereview.chromium.org/1095203005

Cr-Commit-Position: refs/heads/master@{#28055}

[test] Limit "unittests" suite to default variant.

This changes the unittests suite to be run in only the default variant,
because unit tests are (and should be) written to be independent from
global flags.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1067863007

Cr-Commit-Position: refs/heads/master@{#28054}

[turbofan] LiveRange splitting at interval boundary fix.

When splitting live ranges between interval boundary,
the intervals still link eachother. This fixes that.

BUG=

Review URL: https://codereview.chromium.org/1102243002

Cr-Commit-Position: refs/heads/master@{#28053}

Update V8 DEPS.

Rolling v8/tools/clang to cb9ddad752c487e2f4df2bf32df70daaa9afded5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1103043002

Cr-Commit-Position: refs/heads/master@{#28052}

Update V8 DEPS.

Rolling v8/buildtools to 15308f469a704c45d15567fa69cd94ce07ad0e1b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1107773002

Cr-Commit-Position: refs/heads/master@{#28051}

[es6] Map/Set size getter should have "get size" name

This reverts commit d5565c1f689b2953d92abd350529363f04f90fcd.

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

This also moves the logic for handling symbols from runtime-function.cc
to v8natives.js.

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1093183006

Cr-Commit-Position: refs/heads/master@{#28050}

Revert of Lazily register prototype users (patchset #2 id:20001 of https://codereview.chromium.org/1104813004/)

Reason for revert:
Suspected of causing GC stress failures.

Original issue's description:
> Lazily register prototype users
>
> when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
> Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.
>
> Committed: https://crrev.com/a4bb7643c076b014816431a9b85af3e2edf828e7
> Cr-Commit-Position: refs/heads/master@{#28047}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1108583002

Cr-Commit-Position: refs/heads/master@{#28049}

[strong] Simplify the classes-referring-to-classes check.

Follow up for r28032.

We don't need to store the "corresponding outer scope class variables", it's
enough if we transmit the declaration group start to the inner class
variable.

R=rossberg@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1102903002

Cr-Commit-Position: refs/heads/master@{#28048}

Lazily register prototype users

when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.

Review URL: https://codereview.chromium.org/1104813004

Cr-Commit-Position: refs/heads/master@{#28047}

prepare to deprecate non phantom weak callbacks

BUG=

Review URL: https://codereview.chromium.org/1089853005

Cr-Commit-Position: refs/heads/master@{#28046}

[strong] Disallow implicit conversions for binary arithmetic operations

Implements the strong mode proposal's restrictions on
implicit conversions for binary arithmetic operations, not
including the + special case. Adds some infrastructure
for future implementation of the restrictions for other
operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1092353002

Cr-Commit-Position: refs/heads/master@{#28045}

[strong] Sanity fix / follow up for r28032.

ClassVariable should always have the kind CLASS, let's not pretend there
are other options.

R=rossberg@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1106483003

Cr-Commit-Position: refs/heads/master@{#28044}

[turbofan] Fix frame state for class literal definition.

This introduces a bailout point for class literals right after the
%DefineClass function has been called. Otherwise the FrameState after
class literal evaluation might contain the literal itself.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-480819
BUG=chromium:480819
LOG=N

Review URL: https://codereview.chromium.org/1104673004

Cr-Commit-Position: refs/heads/master@{#28043}

Lolcode candidate: Both Expression and FunctionLiteral define an accessor is_parenthesized(), which access different flags. FunctionLiteral derives from Expression.

Given
      FunctionLiteral* a; a->is_parenthesized()
const FunctionLiteral* b; b->is_parenthesized()

the first accesses FunctionLiteral::IsParenthesized, the second accesses Expression::IsParenthesizedField.

Since these are distinct uses, we could rename them based on their use:
- Expression::is_parenthesized -> is_single_parenthesized
  Count # of parenthesis, for parsing & error handling:
  no parenthesis -> single parenthesis -> multi parenthesis
- FunctionLiteral::eager_compile_hint()
  Hint from parser to compiler about whether the parser suggests this function for eager compilation.

BUG=

Review URL: https://codereview.chromium.org/1097723005

Cr-Commit-Position: refs/heads/master@{#28042}

[turbofan] Ignore dead cached nodes in the JSGraph.

BUG=chromium:480807
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1101273002

Cr-Commit-Position: refs/heads/master@{#28041}

Migrate error messages, part 5 (array.js and i18n.js).

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1096243003

Cr-Commit-Position: refs/heads/master@{#28040}

Fix -Wsign-compare bugs with GCC 4.9.2

R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1105653002

Cr-Commit-Position: refs/heads/master@{#28039}

Revert of Reland "Remove the weak list of views from array buffers" (patchset #2 id:20001 of https://codereview.chromium.org/1093183004/)

Reason for revert:
still working on perf

Original issue's description:
> Reland "Remove the weak list of views from array buffers"
>
> Original description:
> > Instead, views have to check their array buffer for whether
> > it's neutered or not.
> >
> > BUG=v8:3996
> > R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> > LOG=n
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n
>
> Committed: https://crrev.com/655b04637e9da2749f53c866bca8f5f6abb05a3f
> Cr-Commit-Position: refs/heads/master@{#28029}

TBR=dslomov@chromium.org,hpayer@chromium.org,verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1053203007

Cr-Commit-Position: refs/heads/master@{#28038}

Revert of Eagerly declare eval scopes, even for sloppy scopes (patchset #2 id:20001 of https://codereview.chromium.org/1085263003/)

Reason for revert:
Regresses CodeLoad (crbug.com/480774).

Original issue's description:
> Eagerly declare eval scopes, even for sloppy scopes
>
> R=marja@chromium.org, mstarzinger@chromium.org
> LOG=N
> BUG=N
>
> Committed: https://crrev.com/fe9efc121c8cba8b6aee1a9cf36c68ee97c44d99
> Cr-Commit-Position: refs/heads/master@{#28027}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1082013003

Cr-Commit-Position: refs/heads/master@{#28037}

Update V8 DEPS.

Rolling v8/tools/clang to ed8476f8e39660d1926dddff78cc8446527f9b9c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1079163012

Cr-Commit-Position: refs/heads/master@{#28036}

Revert of [es6] Map/Set size getter should have "get size" name (patchset #4 id:80001 of https://codereview.chromium.org/1094323005/)

Reason for revert:
Breaks GCMole ia32

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/1685/steps/GCMole%20ia32/logs/stdio

src/runtime/runtime-function.cc:96:3: warning: Possible problem with evaluation order.
  f->shared()->set_name(*NameToFunctionName(name));
  ^
src/runtime/runtime-function.cc:96:3: warning: Possible problem with evaluation order.
2 warnings generated.

Original issue's description:
> [es6] Map/Set size getter should have "get size" name
>
> Getter and setter function names in ES6 are defined as "get foo" and
> "set foo".
>
> BUG=None
> LOG=N
> R=adamk@chromium.org
>
> Committed: https://crrev.com/83c89a2e71a363afb35595f903423e650d788e42
> Cr-Commit-Position: refs/heads/master@{#28034}

TBR=adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=None

Review URL: https://codereview.chromium.org/1106713002

Cr-Commit-Position: refs/heads/master@{#28035}

[es6] Map/Set size getter should have "get size" name

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1094323005

Cr-Commit-Position: refs/heads/master@{#28034}

Empty Array prototype elements protection needs to alert on length change.

If the length of the array prototype is changed, be sure to turn off the
guarantee that it's elements are empty.

This case was missed in https://codereview.chromium.org/1092043002
("Protect the emptiness of Array prototype elements with a PropertyCell")

R=jkummerow@chromium.org
BUG=479781
LOG=N

Review URL: https://codereview.chromium.org/1099453007

Cr-Commit-Position: refs/heads/master@{#28033}

[strong] Stricter check for referring to other classes inside methods.

Add the restriction that both classes must be declared inside the same
consectutive class declaration batch.

Dependency analysis not implemented yet.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1060913005

Cr-Commit-Position: refs/heads/master@{#28032}

Function scopes only must have a context if they call sloppy eval

A strict arrow function with no parameters and no variable bindings
won't need a context object because it will never have any
locals.  (This is unlike strict normal functions, which do have
"arguments" and "this" locals.)

R=rossberg@chromium.org
BUG=v8:4056
LOG=N

Review URL: https://codereview.chromium.org/1093183003

Cr-Commit-Position: refs/heads/master@{#28031}

[turbofan] make LifetimePostion comparable

BUG=

Review URL: https://codereview.chromium.org/1087133004

Cr-Commit-Position: refs/heads/master@{#28030}

Reland "Remove the weak list of views from array buffers"

Original description:
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1093183004

Cr-Commit-Position: refs/heads/master@{#28029}

Simplified 'return' handling in the instruction selector.

The RawMachineAssembler now behaves like the rest of TurboFan,
removing the need for some special cases.

Review URL: https://codereview.chromium.org/1090393003

Cr-Commit-Position: refs/heads/master@{#28028}

Eagerly declare eval scopes, even for sloppy scopes

R=marja@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=N

Review URL: https://codereview.chromium.org/1085263003

Cr-Commit-Position: refs/heads/master@{#28027}

[turbofan] Unify frame state inputs.

Now all nodes that care about deoptimization always take frame state
inputs no matter whether deoptimization is enabled for a particular
function. In case that deoptimization is off, the AstGraphBuilder just
inserts the empty frame state. This greatly simplifies the logic in
various places and makes testing easier as well, and is probably the
first step towards enabling --turbo-deoptimization by default.

There seems to be no noticable performance impact on asm.js programs.

Also fix the graph replay in order to regenerate the scheduler unittests.

Review URL: https://codereview.chromium.org/1106613003

Cr-Commit-Position: refs/heads/master@{#28026}

[turbofan] break link between split use intervals

BUG=

Review URL: https://codereview.chromium.org/1086563004

Cr-Commit-Position: refs/heads/master@{#28025}

Reland Force full GCwhenever CollectAllGarbage is meant to trigger a full GC.

BUG=

Review URL: https://codereview.chromium.org/1099783003

Cr-Commit-Position: refs/heads/master@{#28024}

Update V8 DEPS.

Rolling v8/tools/clang to 39ed8f11082b1f0a226436955efcacc38aed2d5e

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1106553003

Cr-Commit-Position: refs/heads/master@{#28023}

Materialize booleans in the turbofan deoptimizer.

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1055453006

Cr-Commit-Position: refs/heads/master@{#28022}

[es6] Function.prototype.name should be the empty string

ES6 specifies the function name property (it was not part of ES5) and
it specifies the name of Function.prototype to the empty string ("" and
not "Empty"). This makes us match Firefox, Safari and IE developer
preview.

BUG=v8:4033
LOG=N
R=adamk@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1080393004

Cr-Commit-Position: refs/heads/master@{#28021}

Skip poppler and sqlite tests on big-endian platforms.

Emscripten use of typed-arrays is little-endian only.

BUG=

Review URL: https://codereview.chromium.org/1082723007

Cr-Commit-Position: refs/heads/master@{#28020}

[mjsunit] Fix bad test expectations.

BUG=v8:3924,v8:3969,chromium:478788
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/1095893004

Cr-Commit-Position: refs/heads/master@{#28019}

Reland: Introducing the LLVM greedy register allocator.

This change aims to introduce the separation of the RegisterAllocator model, using the initial prototype for GreedyAllocator as proof of concept.

Summary:
- new flag, turbo-greedy-regalloc, enabling the new allocator. Default
  false.
- initial, untested implementation for the GreedyAllocator.

BUG=

Review URL: https://codereview.chromium.org/1061923005

Cr-Commit-Position: refs/heads/master@{#28018}

Revert of Introducing the LLVM greedy register allocator. (patchset #10 id:410001 of https://codereview.chromium.org/1061923005/)

Reason for revert:
Breaks Static Initializers test.

http://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/3210/steps/Static-Initializers/logs/stdio

Original issue's description:
> Introducing the LLVM greedy register allocator.
>
> This change aims to introduce the separation of the RegisterAllocator model,
> using the initial prototype for RegisterAllocatorGreedy as proof of concept.
>
> Summary:
> - new flag, turbo-greedy-regalloc, enabling the new allocator. Default
>   false.
> - separated RegisterAllocator into a base type and two derived,
>   RegisterAllocatorLinear (the one currently used in TurboFan) and
>   RegisterAllocatorGreedy (the new one).
> - initial, untested impementation for the greedy allocator.
>
> BUG=
>
> Committed: https://crrev.com/ec542dea6b6a0cb82d1578a389569d019a59121d
> Cr-Commit-Position: refs/heads/master@{#28015}

TBR=dcarney@chromium.org,titzer@chromium.org,jarin@chromium.org,jvoung@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1080953006

Cr-Commit-Position: refs/heads/master@{#28017}

[es6] Class extends may not be a generator function

BUG=v8:4009
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/1101543002

Cr-Commit-Position: refs/heads/master@{#28016}

Introducing the LLVM greedy register allocator.

This change aims to introduce the separation of the RegisterAllocator model,
using the initial prototype for RegisterAllocatorGreedy as proof of concept.

Summary:
- new flag, turbo-greedy-regalloc, enabling the new allocator. Default
  false.
- separated RegisterAllocator into a base type and two derived,
  RegisterAllocatorLinear (the one currently used in TurboFan) and
  RegisterAllocatorGreedy (the new one).
- initial, untested impementation for the greedy allocator.

BUG=

Review URL: https://codereview.chromium.org/1061923005

Cr-Commit-Position: refs/heads/master@{#28015}

Revert of Remove the weak list of views from array buffers (patchset #6 id:100001 of https://codereview.chromium.org/1094863002/)

Reason for revert:
I'm reverting this while working on the regression fix

Original issue's description:
> Remove the weak list of views from array buffers
>
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n
>
> Committed: https://crrev.com/5ae083a05a6743d6cb91585f449539f7846a5d8c
> Cr-Commit-Position: refs/heads/master@{#27995}

TBR=dslomov@chromium.org,hpayer@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1061753008

Cr-Commit-Position: refs/heads/master@{#28014}

Add test for deoptimization bug.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1100113002

Cr-Commit-Position: refs/heads/master@{#28013}

Blacklist mjsunit/es6/generators-debug-scopes.js from turbofan.

TBR=mstarzinger@chromium.org
NOTRY=true
BUG=v8:4055
LOG=N

Review URL: https://codereview.chromium.org/1098293002

Cr-Commit-Position: refs/heads/master@{#28012}

Revert of Revert of Always optimize for adding properties to native objects. (patchset #1 id:1 of https://codereview.chromium.org/1098223004/)

Reason for revert:
Test failure was not due to this.

Original issue's description:
> Revert of Always optimize for adding properties to native objects. (patchset #1 id:1 of https://codereview.chromium.org/1094383004/)
>
> Reason for revert:
> GC stress failure (custom snapshot)
>
> Original issue's description:
> > Always optimize for adding properties to native objects.
> >
> > R=jkummerow@chromium.org
> >
> > Committed: https://crrev.com/c715098e85b93def76c0b3f54290c811dea04f01
> > Cr-Commit-Position: refs/heads/master@{#28003}
>
> TBR=jkummerow@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/bb6958ceff221e66adbc4581471a8ce1b41a4684
> Cr-Commit-Position: refs/heads/master@{#28009}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1100123002

Cr-Commit-Position: refs/heads/master@{#28011}

Whitespace change for greenification.

Cr-Commit-Position: refs/heads/master@{#28010}

Revert of Always optimize for adding properties to native objects. (patchset #1 id:1 of https://codereview.chromium.org/1094383004/)

Reason for revert:
GC stress failure (custom snapshot)

Original issue's description:
> Always optimize for adding properties to native objects.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/c715098e85b93def76c0b3f54290c811dea04f01
> Cr-Commit-Position: refs/heads/master@{#28003}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1098223004

Cr-Commit-Position: refs/heads/master@{#28009}

Stack allocate lexical locals + hoist stack slots

Review URL: https://codereview.chromium.org/981203003

Cr-Commit-Position: refs/heads/master@{#28008}

Experiment with smaller minimum elements dictionary size

BUG=

Review URL: https://codereview.chromium.org/1094243004

Cr-Commit-Position: refs/heads/master@{#28007}

[turbofan] make live ranges stateless

this is necessary for the greedy allocator to use the relevant functions, as well as the sanity of someone looking at the code

BUG=

Review URL: https://codereview.chromium.org/1056063004

Cr-Commit-Position: refs/heads/master@{#28006}

Introduce "expression classifier" to the parser.

R=marja@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/1065983005

Cr-Commit-Position: refs/heads/master@{#28005}

Add an --omit-quit flag to d8 for Emscripten's sake.

Review URL: https://codereview.chromium.org/1101683002

Cr-Commit-Position: refs/heads/master@{#28004}

Always optimize for adding properties to native objects.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1094383004

Cr-Commit-Position: refs/heads/master@{#28003}

[turbofan] Add a debug_name to Parameter operators.

R=bmeurer@chromium.org, mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1090303004

Cr-Commit-Position: refs/heads/master@{#28002}

Revert of Revert of [strong] checking of this & super in constructors (patchset #1 id:1 of https://codereview.chromium.org/1105453002/)

Reason for revert:
Was an infrastructure problem.

Original issue's description:
> Revert of [strong] checking of this & super in constructors (patchset #7 id:110001 of https://codereview.chromium.org/1024063002/)
>
> Reason for revert:
> [Sheriff] Breaks mac gc stress:
> http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1024
>
> Original issue's description:
> > [strong] checking of this & super in constructors
> >
> > R=dslomov@chromium.org, marja@chromium.org
> > BUG=v8:3956
> > LOG=N
> >
> > Enforces for constructors that
> > - the only use of 'super' is the super constructor call
> > - the only use of 'this' is a property assignment
> > - both of these must happen at the top-level of the body
> > - 'this' may only be assigned after the 'super' call
> > - 'return' may only be used after the last assignment to 'this'
> >
> > Not yet working for arrow functions (there might be deeper bugs with those).
> >
> > Committed: https://crrev.com/580d66bcda66220d2f3062ac58daf925436df74c
> > Cr-Commit-Position: refs/heads/master@{#27977}
>
> TBR=dslomov@chromium.org,marja@chromium.org,conradw@chromium.org,rossberg@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3956

TBR=dslomov@chromium.org,marja@chromium.org,conradw@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1073103004

Cr-Commit-Position: refs/heads/master@{#28001}

Revert of Revert of Protect the emptiness of Array prototype elements with a PropertyCell. (patchset #1 id:1 of https://codereview.chromium.org/1099203004/)

Reason for revert:
This was probably an infrastructure problem caused by the mac ninja/goma switch.

Original issue's description:
> Revert of Protect the emptiness of Array prototype elements with a PropertyCell. (patchset #7 id:120001 of https://codereview.chromium.org/1092043002/)
>
> Reason for revert:
> MAC GCSTRESS failure on new test.
>
> Original issue's description:
> > Protect the emptiness of Array prototype elements with a PropertyCell.
> >
> > Not just emptiness, but also a particular structure.
> >
> > BUG=v8:4044
> > LOG=N
>
> TBR=jkummerow@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4044

TBR=jkummerow@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4044

Review URL: https://codereview.chromium.org/1052253003

Cr-Commit-Position: refs/heads/master@{#28000}

Revert of Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #1 id:1 of https://codereview.chromium.org/1103473003/)

Reason for revert:
This was probably an infrastructure problem caused by the mac ninja/goma switch.

Original issue's description:
> Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #7 id:140001 of https://codereview.chromium.org/1011823003/)
>
> Reason for revert:
> [Sheriff] breaks mac gc stress:
> http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1029
>
> Original issue's description:
> > [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions)
> >
> > BUG=v8:3965, v8:3966
> > R=arv@chromium.org
> > LOG=N
> >
> > Committed: https://crrev.com/b09c048f693d280052ac63c7d6b3baf27b3bf271
> > Cr-Commit-Position: refs/heads/master@{#27985}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3965, v8:3966

TBR=arv@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3965, v8:3966

Review URL: https://codereview.chromium.org/1098243002

Cr-Commit-Position: refs/heads/master@{#27999}

Revert of Protect the emptiness of Array prototype elements with a PropertyCell. (patchset #7 id:120001 of https://codereview.chromium.org/1092043002/)

Reason for revert:
MAC GCSTRESS failure on new test.

Original issue's description:
> Protect the emptiness of Array prototype elements with a PropertyCell.
>
> Not just emptiness, but also a particular structure.
>
> BUG=v8:4044
> LOG=N

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4044

Review URL: https://codereview.chromium.org/1099203004

Cr-Commit-Position: refs/heads/master@{#27998}

Revert of Revert of [es6] implement Array.prototype.copyWithin() (patchset #1 id:1 of https://codereview.chromium.org/1084183004/)

Reason for revert:
Check if this CL fails independently of https://chromium.googlesource.com/v8/v8/+/580d66bcda66220d2f3062ac58daf925436df74c

Original issue's description:
> Revert of [es6] implement Array.prototype.copyWithin() (patchset #7 id:120001 of https://codereview.chromium.org/376623004/)
>
> Reason for revert:
> [Sheriff] This causes test failures on mac gc stress:
> http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1027
>
> Original issue's description:
> > [es6] implement Array.prototype.copyWithin()
> >
> > https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.copywithin
> >
> > BUG=v8:4039
> > R=adamk@chromium.org
> > LOG=N
>
> TBR=dslomov@chromium.org,rossberg@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4039
>
> Committed: https://crrev.com/9283fc89710e59445bdc4479454fba97ab9ebdd7
> Cr-Commit-Position: refs/heads/master@{#27984}

TBR=dslomov@chromium.org,rossberg@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4039

Review URL: https://codereview.chromium.org/1072193005

Cr-Commit-Position: refs/heads/master@{#27997}

[mjsunit] Import asm.js test case for poppler.

R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1105483002

Cr-Commit-Position: refs/heads/master@{#27996}

Remove the weak list of views from array buffers

Instead, views have to check their array buffer for whether
it's neutered or not.

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1094863002

Cr-Commit-Position: refs/heads/master@{#27995}

add StdGlobalValueMap

BUG=

Review URL: https://codereview.chromium.org/1104463002

Cr-Commit-Position: refs/heads/master@{#27994}

Protect the emptiness of Array prototype elements with a PropertyCell.

Not just emptiness, but also a particular structure.

BUG=v8:4044
LOG=N

Review URL: https://codereview.chromium.org/1092043002

Cr-Commit-Position: refs/heads/master@{#27993}

[mjsunit] Skip newly added tests under asan.

TBR=svenpanne@chromium.org, titzer@chromium.org, bmeurer@chromium.org,
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1101653002

Cr-Commit-Position: refs/heads/master@{#27992}

Revert of [strong] checking of this & super in constructors (patchset #7 id:110001 of https://codereview.chromium.org/1024063002/)

Reason for revert:
[Sheriff] Breaks mac gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1024

Original issue's description:
> [strong] checking of this & super in constructors
>
> R=dslomov@chromium.org, marja@chromium.org
> BUG=v8:3956
> LOG=N
>
> Enforces for constructors that
> - the only use of 'super' is the super constructor call
> - the only use of 'this' is a property assignment
> - both of these must happen at the top-level of the body
> - 'this' may only be assigned after the 'super' call
> - 'return' may only be used after the last assignment to 'this'
>
> Not yet working for arrow functions (there might be deeper bugs with those).
>
> Committed: https://crrev.com/580d66bcda66220d2f3062ac58daf925436df74c
> Cr-Commit-Position: refs/heads/master@{#27977}

TBR=dslomov@chromium.org,marja@chromium.org,conradw@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1105453002

Cr-Commit-Position: refs/heads/master@{#27991}

Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #7 id:140001 of https://codereview.chromium.org/1011823003/)

Reason for revert:
[Sheriff] breaks mac gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1029

Original issue's description:
> [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions)
>
> BUG=v8:3965, v8:3966
> R=arv@chromium.org
> LOG=N
>
> Committed: https://crrev.com/b09c048f693d280052ac63c7d6b3baf27b3bf271
> Cr-Commit-Position: refs/heads/master@{#27985}

TBR=arv@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3965, v8:3966

Review URL: https://codereview.chromium.org/1103473003

Cr-Commit-Position: refs/heads/master@{#27990}

[mjsunit] Add custom tests based on SQLite 3.8.9.

Also adjust the test runner to remove --always-opt for FAST_VARIANTS.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1056423004

Cr-Commit-Position: refs/heads/master@{#27989}