Separated the new register allocator in its own files.

Opportunistically removed GreedyAllocator::TryReuseSpillForPhi because it is actually unsuitable for Greedy. It was copied from Linear and it relies on hints, however, the current implementation of hints assumes linear scan.

This change doesn't aim to address performance nor correctness for Greedy.

BUG=

Review URL: https://codereview.chromium.org/1184183002

Cr-Commit-Position: refs/heads/master@{#29054}

Only shrink new space when we are not in the process of obtaining pretenuring feedback.

BUG=

Review URL: https://codereview.chromium.org/1180263006

Cr-Commit-Position: refs/heads/master@{#29053}

Re-land new insertion write barrier.

BUG=

Review URL: https://codereview.chromium.org/1153233003

Cr-Commit-Position: refs/heads/master@{#29052}

Updates to the license information of third party components.

LOG=n

Review URL: https://codereview.chromium.org/1183743003

Cr-Commit-Position: refs/heads/master@{#29051}

Re-Re-land: Enable external startup by default on Linux.

crrev.com/1177163002 should have fixed the issues that broke this last time.

Notes:
- The current functionality is meant to stay. If you prefer the old way,
  just set v8_use_external_startup_data=0.
- You might notice this if you call d8 via PATH. Either explicitly tell d8
  where your external snapshot/built-ins are, or change the build options
  as above.
- This follows Chromium practice, that mostly uses this feature these days.
- Other platforms to follow later.

BUG=

Review URL: https://codereview.chromium.org/1189563004

Cr-Commit-Position: refs/heads/master@{#29050}

X87: enable the X87 turbofan support.

    This patch includes the following changes.
     1, Enable the turbofan backend support for X87 platform. It depends on previous CL: 3fdfebd26.
     2, Enable the test cases which are disabled because turbofan for X87 was not enabled.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1179763004

Cr-Commit-Position: refs/heads/master@{#29049}

[V8] Fixed infinite loop in Debug::PrepareStep

frame->GetExpression always returns the same function. We should iterate through expression stack when we use Function.call.apply for finding actual target.

LOG=N
BUG=chromium:499479
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1182703003

Cr-Commit-Position: refs/heads/master@{#29048}

Serializer: support all alignment kinds.

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
Cr-Commit-Position: refs/heads/master@{#29044}

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29047}

Revert of Decompiler improvements. (patchset #2 id:20001 of https://codereview.chromium.org/1177123002/)

Reason for revert:
Code printout has become unreadable. Offsets are printed in decimal numbers everywhere else. This is inconsistent with the rest of the code-base. Some examples are tables for deoptimization data, safepoints and exception handlers. I would be fine with this change if _all_ tracing would be adapted. But there are _many_ places to touch.

Original issue's description:
> Decompiler improvements.
>
> The main motivation is simplifying profiling activities:
>
> 1) Use hex instead of decimal for offsets, just like perf does. This
> affects --print-opt-code
>
> 2) When printing block information, indicate loop information: if
> block is header, where the end is; if block is in a loop, where the
> loop starts. This affects --code-comments.
>
> Using --print-opt-code --code-comments, and cross-referencing with data
> obtained from perf, one may now find the block a hotspot belongs to
> without needing to do hex2dec/dec2hex conversions. Once found, loop info
> is available locally, on the block.
>
> BUG=
>
> Committed: https://crrev.com/32f4bd659d38eb5485eedb1d0dd236ff1bdc01d5
> Cr-Commit-Position: refs/heads/master@{#28964}

TBR=jarin@chromium.org,stichnot@chromium.org,jvoung@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1188093002

Cr-Commit-Position: refs/heads/master@{#29046}

Revert of Serializer: support all alignment kinds. (patchset #3 id:40001 of https://codereview.chromium.org/1179873003/)

Reason for revert:
[Sheriff] Breaks arm debug compile:
http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/4308

Original issue's description:
> Serializer: support all alignment kinds.
>
> We use an alignment prefix for unusual alignment kinds (not kWordAligned).
> This will cause new objects to be aligned in ReadObject, and back references
> to be aligned to skip padding.
>
> The motivation to change the undefined next sentinel in WeakCell is this:
> When the deserializer aligns an object, it requires filler maps to already
> exist to create filler objects as padding. However, deserializing the
> filler map leads to deserializing NaN, which as heap number is aligned:
> filler map > meta map > weak cell cache > undefined > NaN
> If we use the-hole instead of undefined as sentinel, it works.
>
> R=jochen@chromium.org,bbudge@chromium.org
> BUG=v8:4178
> LOG=N
>
> Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
> Cr-Commit-Position: refs/heads/master@{#29044}

TBR=jochen@chromium.org,bbudge@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4178

Review URL: https://codereview.chromium.org/1173253006

Cr-Commit-Position: refs/heads/master@{#29045}

Serializer: support all alignment kinds.

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29044}

[turbofan] Work around negative parameter count.

BUG=chromium:500824
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186333002

Cr-Commit-Position: refs/heads/master@{#29043}

Fix compile warning [-Wtype-limits]

This fixes warning on android_arm build.
Previously the compiler complained about a check that can never be true.
See second check below(index is size_t type, FIRST_SPACE=0):
if (index > i::LAST_SPACE || index < i::FIRST_SPACE)
And make the code easy to understand.

BUG=

Review URL: https://codereview.chromium.org/1155043005

Cr-Commit-Position: refs/heads/master@{#29042}

All private symbols are own symbols

R=rossberg@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1182303004

Cr-Commit-Position: refs/heads/master@{#29041}

[crankshaft] Fix wrong bailout points in for-in loop body.

R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}

Introduce a base pointer field in FixedTypedArrayBase and teach GC about it

This is the first step towards unifying external and on-heap typed arrays.

The end-state will be that this base pointer either points to the on-heap values
or to the externally allocated array buffer.

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1176263004

Cr-Commit-Position: refs/heads/master@{#29039}

Debugger: require debugger to be active when dealing with breaks.

This invariant will save us some head ache.
The changes to test-debug/DebugStub is due to the fact that it abuses
the ability to set break points in code that has no debug break slots.
This is now no longer possible.

R=ulan@chromium.org
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1181013007

Cr-Commit-Position: refs/heads/master@{#29038}

[deoptimizer] Use TranslationIterator for OptimizedFrame again.

Using TranslatedState and friends is too expensive compared to the low
level TranslationIterator, because some code (i.e. in Speedometer)
depends on the OptimizedFrame summary/function listing to be very fast.

BUG=chromium:499338
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181373003

Cr-Commit-Position: refs/heads/master@{#29037}

[turbofan] Remove dead code from JSGenericLowering.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186573004

Cr-Commit-Position: refs/heads/master@{#29036}

Update V8 DEPS.

Rolling v8/build/gyp to 79de4031069f37870f04e8b6bbf42f0c7fec37aa

Rolling v8/tools/clang to 66ba82eea5b4e2309c220cc3e0f2d67ebc3fff4c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1187073008

Cr-Commit-Position: refs/heads/master@{#29035}

MIPS: Fix for Remove unsafe EmitLoadRegister usage in AddI/SubI for constant right operand.

Fix a missed addiu->Addu, and a bad default use of 'at' register in https://codereview.chromium.org/1185143002/

TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1187063002

Cr-Commit-Position: refs/heads/master@{#29034}

Inline code generation for %_IsTypedArray

This patch implements %_IsTypedArray in fullcodegen, Hydrogen and
Turbofan in order to implement fast type checks to enable ES6
TypedArray features and semantics efficiently.

R=adamk,titzer
LOG=Y
BUG=v8:4085

Review URL: https://codereview.chromium.org/1183213002

Cr-Commit-Position: refs/heads/master@{#29033}

Avoid using computed property literals in TypedArrays code

Computed property literals don't seem to work in nosnap yet,
leading to a syntax error.

R=adamk,arv

Review URL: https://codereview.chromium.org/1189643002

Cr-Commit-Position: refs/heads/master@{#29032}

Allow TypedArrays to be initialized with iterables

In ES6, the TypedArray constructor can be called either with an
array-like object or an iterable. The code previously handled
only array-like objects. This patch switches to supporting
iterables while throwing in an optimization to make Arrays
get allocated the old way, without an extra copy.

BUG=v8:4090
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1181903003

Cr-Commit-Position: refs/heads/master@{#29031}

MIPS: Remove unsafe EmitLoadRegister usage in AddI/SubI for constant right operand.

TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1185143002

Cr-Commit-Position: refs/heads/master@{#29030}

[destructuring] Parse binding patterns in formal parameters.

R=arv@chromium.org,wingo@igalia.com,caitpotter88@gmail.com
LOG=N
BUG=v8:811

Review URL: https://codereview.chromium.org/1167393005

Cr-Commit-Position: refs/heads/master@{#29029}

[turbofan] Remove the TryLowerDirectJSCall hack from generic lowering.

The TryLowerDirectJSCall method tried to lower to a direct JavaScript
function call depending on the type of the receiver, but only if the
target is a cosntant JSFunction. Since this depends on types and is not
required for correctness, it shouldn't be part of generic lowering
anyway. So this functionality was moved to typed lowering instead, and
we use proper types for the target instead.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1182193005

Cr-Commit-Position: refs/heads/master@{#29028}

Remove the --collect-maps flag. Maps should be always collected.

Reasons:
- It is not used.
- It complicates code in GC.

BUG=chromium:499713
LOG=NO

Review URL: https://codereview.chromium.org/1184723002

Cr-Commit-Position: refs/heads/master@{#29027}

[strong] Make strong 'this' optional for experimentation

R=arv@chromium.org, conradw@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1180943007

Cr-Commit-Position: refs/heads/master@{#29026}

[turbofan] Remove context canonicalization hack from generic lowering.

This hack doesn't help currently, since it only applies to asm.js where
we do function context specialization and there we already have a
canonicalized context (and the CodeGenerator materializes that from the
frame).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177033006

Cr-Commit-Position: refs/heads/master@{#29025}

MIPS64: Reland 'Enable shorten-64-to-32 warning.'

Port cdc43bc5fd02fff2905e2e28a79054d0d1eee3ea

Original review: https://codereview.chromium.org/1133163005/

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1182193004

Cr-Commit-Position: refs/heads/master@{#29024}

Fix -Wsign-compare errors in TF tests under GCC 4.9.2

R=jkummerow@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1191433003

Cr-Commit-Position: refs/heads/master@{#29023}

Revert of Fix clobbered register when setting this_function variable. (patchset #2 id:20001 of https://codereview.chromium.org/1185703002/)

Reason for revert:
[Sheriff] Makes mjsunit/es6/block-const-assign flaky, e.g.:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/4082

Original issue's description:
> Fix clobbered register when setting this_function variable.
>
> R=arv@chromium.org
> TEST=mjsunit/regress/regress-crbug-498022
> BUG=chromium:498022
> LOG=N
>
> Committed: https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91
> Cr-Commit-Position: refs/heads/master@{#29020}

TBR=arv@chromium.org,rossberg@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:498022

Review URL: https://codereview.chromium.org/1184093003

Cr-Commit-Position: refs/heads/master@{#29022}

[mjsunit] regress/regress-crbug-491062 takes too long with --always-opt.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1183133002

Cr-Commit-Position: refs/heads/master@{#29021}

Fix clobbered register when setting this_function variable.

R=arv@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1185703002

Cr-Commit-Position: refs/heads/master@{#29020}

Fix debug printing of inputs in the deoptimizer, pull out printing into separate methods.

Also fixed the duplicated output of context deopt.

BUG=

Review URL: https://codereview.chromium.org/1187533002

Cr-Commit-Position: refs/heads/master@{#29019}

[mjsunit] Remove unsupported flag --turbo-deoptimization from tests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}

[mjsunit] Remove obsolete nosse2 tests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1186713003

Cr-Commit-Position: refs/heads/master@{#29017}

Serializer: clear string hash for code serializer.

R=jochen@chromium.org
BUG=v8:4179
LOG=N

Review URL: https://codereview.chromium.org/1183483006

Cr-Commit-Position: refs/heads/master@{#29016}

Compute the heap growing factor based on mutator utilization and allocation throughput.

Doc: https://goo.gl/LLGvBs

BUG=

Review URL: https://codereview.chromium.org/1163143009

Cr-Commit-Position: refs/heads/master@{#29015}

Reland "Keep track of array buffers in new space separately"

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177293003

Cr-Commit-Position: refs/heads/master@{#29014}

Update V8 DEPS.

Rolling v8/third_party/android_tools to ed3dde6470c39b196c70f0c20374894d169754ec

Resubmission of https://codereview.chromium.org/1183753006/

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/1181413003

Cr-Commit-Position: refs/heads/master@{#29013}

Add test for code caching API.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180113002

Cr-Commit-Position: refs/heads/master@{#29012}

[turbofan] Mark MachineType as uint16_t.

This fixes a few funky implicit conversions for the enum (that are
inconsistent across compilers) and also helps to save space, i.e. for
the representations_ vector in the InstructionSequence.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1182303003

Cr-Commit-Position: refs/heads/master@{#29011}

[turbofan] Remove unused typedef VirtualRegisterSet.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1179913003

Cr-Commit-Position: refs/heads/master@{#29010}

Revert of Reland "Keep track of array buffers in new space separately" (patchset #2 id:20001 of https://codereview.chromium.org/1177083003/)

Reason for revert:
Still broken

Original issue's description:
> Reland "Keep track of array buffers in new space separately"
>
> Original review https://codereview.chromium.org/1133773002/
>
> BUG=v8:3996
> TBR=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/89b9a2cfb317e52186f682c91502b22932d52db3
> Cr-Commit-Position: refs/heads/master@{#28987}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1186613007

Cr-Commit-Position: refs/heads/master@{#29009}

Also handle elements in *RealNamed* api methods

Apparently the *RealNamed* API methods only have named variants, but were always used by the embedder to find elements as well. We'd never find them though, since we wouldn't even look
there.

This CL ensures we check whether the name is actually an array index.

I guess for all named API functions we should assume they are used similar to o["name"] where name could also be a number... At least we should make it uniform between embedder and V8. This matches us up with their expectations for now...

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177383004

Cr-Commit-Position: refs/heads/master@{#29008}

Update V8 DEPS.

Rolling v8/tools/clang to bb23ac0328fd3d051fc2f5ff027c8e0f87cc6fb5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1186753003

Cr-Commit-Position: refs/heads/master@{#29007}

Remove some unused definitions from d8.h

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184853003

Cr-Commit-Position: refs/heads/master@{#29006}

Currently on X87 platform we use only Double register (stack register) for Turbofan. So we directly
use 1 as allocatable Double register number when setting up the default register configuration..

It does not change the double register configuration of other platforms.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1164813007

Cr-Commit-Position: refs/heads/master@{#29005}

Introduce LookupIterator::PropertyOrElement which converts name to index if possible.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178893002

Cr-Commit-Position: refs/heads/master@{#29004}

X87: Disable the test case for X87 since ea2cb139d.

      The strong-object-set-proto test cases will throw one expected exception
      and the exception message should include the source position in the JS
      file. But crankshaft compiler does not generate the source position for
      it when creating the flow graph by default. The source position information
      is always zero. So it failed when comparing with the reference file.

      If we use crankshaft compiler on IA32 platform to run this test case, it
      has the same failure.

      we will open these test case for x87 once turbofan for X87 is enabled.

BUG=

Review URL: https://codereview.chromium.org/1179763003

Cr-Commit-Position: refs/heads/master@{#29003}

Introduce DefineOwnPropertyIgnoreAttributes and make it call SetPropertyWithInterceptor.

Otherwise using Object.defineProperty with window.localStorage will not actually store the value into the database but on the object itself.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180073002

Cr-Commit-Position: refs/heads/master@{#29002}

[test] More debugging output in test runner.

Also use again the taskkill method, recently removed in
https://codereview.chromium.org/1156133006/

BUG=chromium:485932
LOG=n
TBR=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177903005

Cr-Commit-Position: refs/heads/master@{#29001}

Reland of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180943002

Cr-Commit-Position: refs/heads/master@{#29000}

Map::TryUpdate() must be in sync with Map::Update().

This CL fixes elements kind transitions handling in Map::TryUpdate().

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1181163002

Cr-Commit-Position: refs/heads/master@{#28999}

Add script context with context-allocated "const this"

This is a reapplication of https://codereview.chromium.org/1173333004.

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1178903003

Cr-Commit-Position: refs/heads/master@{#28998}

[turbofan] Use appropriate type for NodeId.

Up until now we used int32_t for NodeId, but that was not ideal because
negative values are invalid for NodeId and we use it as an array index
for example in the NodeMarker class, where C++ compilers on x64 have to
generate code that does proper sign extension for the indices, which is
completely unnecessary.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1178403004

Cr-Commit-Position: refs/heads/master@{#28997}

Revert of Add script context with context-allocated "const this" (patchset #2 id:20001 of https://codereview.chromium.org/1173333004/)

Reason for revert:
nosnap failure

Original issue's description:
> Add script context with context-allocated "const this"
>
> This is a reapplication of https://codereview.chromium.org/1179893002/.
>
> R=rossberg@chromium.org,mstarzinger@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/cfc764f4050edc74aef92daa4c39ccc113893968
> Cr-Commit-Position: refs/heads/master@{#28994}

TBR=mstarzinger@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1177903004

Cr-Commit-Position: refs/heads/master@{#28996}

MIPS64: Fix memory allocation when code range is used for LO space only.

Allocation must respect requested reserve size, not requested commit area size.

Additionally fix check failures in debug mode for mips64.
After CL: https://codereview.chromium.org/1147503002/
memory for large code objects is allocated from code range,
memory for regular code objects is allocated normally.

TEST=cctest/test-spaces/MemoryChunk
BUG=

Review URL: https://codereview.chromium.org/1172333002

Cr-Commit-Position: refs/heads/master@{#28995}

Add script context with context-allocated "const this"

This is a reapplication of https://codereview.chromium.org/1179893002/.

R=rossberg@chromium.org,mstarzinger@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1173333004

Cr-Commit-Position: refs/heads/master@{#28994}

[turbofan] Move RawMachineAssembler to unittests.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177353003

Cr-Commit-Position: refs/heads/master@{#28993}

Revert of Add script context with context-allocated "const this" (patchset #7 id:120001 of https://codereview.chromium.org/1179893002/)

Reason for revert:
[Sheriff] Breaks gc mole:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/2435

Original issue's description:
> Add script context with context-allocated "const this"
>
> R=rossberg@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/fa32d461c16a053cc6d48d3fb326016bc2765765
> Cr-Commit-Position: refs/heads/master@{#28988}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1180043004

Cr-Commit-Position: refs/heads/master@{#28992}

Revert of MIPS64: Enable shorten-64-to-32 warning. (patchset #12 id:240001 of https://codereview.chromium.org/1133163005/)

Reason for revert:
Compile failure: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac64%20-%20debug/builds/3070/steps/compile/logs/stdio

Original issue's description:
> MIPS64: Enable shorten-64-to-32 warning.
>
> Port cdc43bc5fd02fff2905e2e28a79054d0d1eee3ea
>
> Original commit message:
> Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
> that arise.
>
> BUG=
>
> Committed: https://crrev.com/9af578a7c83b58a0ce25345998d9287cbf2030cb
> Cr-Commit-Position: refs/heads/master@{#28990}

TBR=danno@chromium.org,martyn.capewell@arm.com,paul.lind@imgtec.com,akos.palfi@imgtec.com,dusan.milosavljevic@imgtec.com,jkummerow@chromium.org,machenbach@chromium.org,svenpanne@chromium.org,balazs.kilvady@imgtec.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1182493007

Cr-Commit-Position: refs/heads/master@{#28991}

MIPS64: Enable shorten-64-to-32 warning.

Port cdc43bc5fd02fff2905e2e28a79054d0d1eee3ea

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1133163005

Cr-Commit-Position: refs/heads/master@{#28990}

External snapshot: allow empty snapshot for external snapshot.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180043003

Cr-Commit-Position: refs/heads/master@{#28989}

Add script context with context-allocated "const this"

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1179893002

Cr-Commit-Position: refs/heads/master@{#28988}

Reland "Keep track of array buffers in new space separately"

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177083003

Cr-Commit-Position: refs/heads/master@{#28987}

Whitespace change to test infra clean-ups.

Cr-Commit-Position: refs/heads/master@{#28986}

Update PrintStack signature in gdbinit

BUG=none
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1179053004

Cr-Commit-Position: refs/heads/master@{#28985}

Add support for walking stack frames from hydrogen stubs

R=yangguo@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184493003

Cr-Commit-Position: refs/heads/master@{#28984}

[turbofan] Inline hot functions for NodeMarkerBase.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1184693002.

Cr-Commit-Position: refs/heads/master@{#28983}

Whitespace change to test infra clean-ups.

Cr-Commit-Position: refs/heads/master@{#28982}

Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1182513002/)

Reason for revert:
[Sheriff] Speculative revert for changing layout tests:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/379/layout-test-results/results.html

Exact blame assignment is not possible as our blink bots were in a bad state for a few builds.

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> BUG=N
> LOG=N
> R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/4e2a673881c55a13124dd62f2d05c8d9fe233cd3
> Cr-Commit-Position: refs/heads/master@{#28968}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186463002

Cr-Commit-Position: refs/heads/master@{#28981}

[turbofan] Use RootIndexMap to speed up IsMaterializableFromRoot predicate.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181123002

Cr-Commit-Position: refs/heads/master@{#28980}

Revert of Keep track of array buffers in new space separately (patchset #4 id:60001 of https://codereview.chromium.org/1133773002/)

Reason for revert:
GC stress unhappy

Original issue's description:
> Keep track of array buffers in new space separately
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/506397d0a4241c19f5fab890e49e22d1d9b28bdc
> Cr-Commit-Position: refs/heads/master@{#28978}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1178403003

Cr-Commit-Position: refs/heads/master@{#28979}

Keep track of array buffers in new space separately

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1133773002

Cr-Commit-Position: refs/heads/master@{#28978}

Reland [arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179893003

Cr-Commit-Position: refs/heads/master@{#28977}

[turbofan] Prefer add/shift over madd on ARM64

Before selecting multiply-accumulate for a multiplication with add operation,
check that the multiply can't be reduced to add-with-shift. This prevents
simple multiplications by 3, 5, etc turning into register moves and madd
instructions.

Review URL: https://codereview.chromium.org/1180863002

Cr-Commit-Position: refs/heads/master@{#28976}

[turbofan] Fix throwing conversion inserted by JSTypedLowering.

This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}

Update V8 DEPS.

Rolling v8/tools/clang to 8b3ed2cb2e2512fa1074043cea3ada1143b80f26

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1179113002

Cr-Commit-Position: refs/heads/master@{#28974}

Use LookupIterator in GetOldValue

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178123003

Cr-Commit-Position: refs/heads/master@{#28973}

Add ToObject call in Array.prototype.sort

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}

[es6] Make sure we call add property when adding a new property

When setting a property using `super.prop = val` we need to use
add property if we are adding a new property and not set property.

BUG=493566
LOG=N
R=verwaest@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1161073002

Cr-Commit-Position: refs/heads/master@{#28971}

Remove ASSERT, this method can handle ExternalArrays just fine.

BUG=v8:4137
LOG=n
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1179983002.

Cr-Commit-Position: refs/heads/master@{#28970}

In Array.of and Array.from, fall back to DefineOwnProperty

%AddElement is not intended for objects which are not arrays, and
its behavior may go away with future refactorings. This patch gets
rid of it if the receiver of from or of is not the intrinsic Array
object.

Array.of and Array.from previously papered over failures in calling
[[DefineOwnProperty]] when setting array elements. This patch
makes them lead to exceptions, and adds tests to assert that
the appropriate exceptions are thrown.

BUG=v8:4168
R=adamk
CC=rossberg,verwaest
LOG=Y

Review URL: https://codereview.chromium.org/1181623003

Cr-Commit-Position: refs/heads/master@{#28969}

[es6] Bound function names

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

BUG=N
LOG=N
R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1182513002

Cr-Commit-Position: refs/heads/master@{#28968}

Reland of Use the LookupIterator in SetAccessor (patchset #1 id:1 of https://codereview.chromium.org/1175323004/)

Reason: Didn't break anything

Original issue's description:
> Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
>
> Reason for revert:
> Blocks reverting of https://codereview.chromium.org/1175973002
>
> Original issue's description:
> > Use the LookupIterator in SetAccessor
> >
> > BUG=v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> > Cr-Commit-Position: refs/heads/master@{#28955}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4137
>
> Committed: https://crrev.com/11dbd29de57b290ee8dac2a782a53f879beb416f
> Cr-Commit-Position: refs/heads/master@{#28956}

TBR=jkummerow@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181813002

Cr-Commit-Position: refs/heads/master@{#28967}

Revert of Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #1 id:1 of https://codereview.chromium.org/1179933002/)

Reason for revert:
Reland, this didn't break anything.

Original issue's description:
> Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)
>
> Reason for revert:
> It broke webkit_unit_tests
>
> Original issue's description:
> > Remove GetAttributes from the mix to avoid another virtual dispatch.
> >
> > BUG=chromium:495949,v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> > Cr-Commit-Position: refs/heads/master@{#28953}
>
> TBR=verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:495949,v8:4137
>
> Committed: https://crrev.com/ae639d2ad646237e2f413259a0f116845ef96440
> Cr-Commit-Position: refs/heads/master@{#28958}

TBR=ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1182603002

Cr-Commit-Position: refs/heads/master@{#28966}

Restore ExecutableAccessorInfoHandling for now

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1173283004.

Cr-Commit-Position: refs/heads/master@{#28965}

Decompiler improvements.

The main motivation is simplifying profiling activities:

1) Use hex instead of decimal for offsets, just like perf does. This
affects --print-opt-code

2) When printing block information, indicate loop information: if
block is header, where the end is; if block is in a loop, where the
loop starts. This affects --code-comments.

Using --print-opt-code --code-comments, and cross-referencing with data
obtained from perf, one may now find the block a hotspot belongs to
without needing to do hex2dec/dec2hex conversions. Once found, loop info
is available locally, on the block.

BUG=

Review URL: https://codereview.chromium.org/1177123002

Cr-Commit-Position: refs/heads/master@{#28964}

Use LookupIterator for elements in the observed part of DefineAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177103003

Cr-Commit-Position: refs/heads/master@{#28963}

Use LookupIterator for elements in GetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178083002

Cr-Commit-Position: refs/heads/master@{#28962}

Bound functions should also have configurable length

BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

PPC: smi test optimization

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1177263002

Cr-Commit-Position: refs/heads/master@{#28960}

Reconfigure on the right holder, which might be a hidden object.

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178953003.

Cr-Commit-Position: refs/heads/master@{#28959}

Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

Use the LookupIterator in SetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}