Disable more failing tests after f3338dd3b01c.

TBR=jkummerow@chromium.org
TEST=mjsunit/debug-ignore-breakpoints
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1087673003

Cr-Commit-Position: refs/heads/master@{#27881}

Simplify DoParseProgram

DoParseProgram doesn't appear to need to receive toplevel scopes as
arguments; it can properly set the end_position of the scopes to the
scanner's position after parsing is complete.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1091743002

Cr-Commit-Position: refs/heads/master@{#27880}

Wrap map and set implementation in functions.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1094563002

Cr-Commit-Position: refs/heads/master@{#27879}

Migrate error messages, part 2.

Motivation for this is reducing the size of the native context.

Review URL: https://codereview.chromium.org/1086313003

Cr-Commit-Position: refs/heads/master@{#27878}

X87: Use Cells to check prototype chain validity (disabled by default).

port 0179ec57975c5063bbecd98e11cdda77ddad8996 (r27846).

original commit message:

 The cells are stored on prototypes (in their map's PrototypeInfo). When a
 prototype object changes its map, then both its own validity cell and those
 of all "downsstream" prototypes are invalidated; handlers for a given receiver
 embed the currently valid cell for that receiver's prototype during their
 compilation and check it on execution.

BUG=

Review URL: https://codereview.chromium.org/1090803002

Cr-Commit-Position: refs/heads/master@{#27877}

Make store buffer more robust to OOM.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1086263002

Cr-Commit-Position: refs/heads/master@{#27876}

X87: Array() in optimized code can create with wrong ElementsKind in corner cases

port 13459c1ae3caa4cc546c522177bac5450a3252bf (r27857)

original commit message:

    Array() in optimized code can create with wrong ElementsKind in corner cases.

    Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
    makes a stub call that bails out due to the length. Currently, the bailout
    code a) doesn't have the allocation site, and b) wouldn't use it if it did
    because the length is perceived to be too high.

    This CL passes the allocation site to the stub call (rather than undefined),
    and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1088423002

Cr-Commit-Position: refs/heads/master@{#27875}

Add missing Handle to GetOrCreatePrototypeChainValidityCell

Follow-up to 333219a745ca.

NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1095503002

Cr-Commit-Position: refs/heads/master@{#27874}

X87: VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

port 776770c0e4e9cffad408581962ca90f247ac66f0 (r27827).

original commit message:

  This needs "Pass load ic state through the Oracle"
  (https://codereview.chromium.org/1083933002/) to land first.

BUG=

Review URL: https://codereview.chromium.org/1093433004

Cr-Commit-Position: refs/heads/master@{#27873}

Enable Cell-based prototype chain checks

Review URL: https://codereview.chromium.org/1070253004

Cr-Commit-Position: refs/heads/master@{#27872}

Revert of Experiment: reduce heap growing factor to investigate OOM impact. (patchset #4 id:60001 of https://codereview.chromium.org/1060533003/)

Reason for revert:
Experiment done.

Original issue's description:
> Experiment: reduce heap growing factor to investigate OOM impact.
>
> This CL will be reverted after getting sufficient data.
> BUG=
>
> Committed: https://crrev.com/8b737395c8fcde35cbfbed6607f767ed48eefc5b
> Cr-Commit-Position: refs/heads/master@{#27804}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1085353003

Cr-Commit-Position: refs/heads/master@{#27871}

[turbofan] Clean up cached nodes in JSGraph.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1080023002

Cr-Commit-Position: refs/heads/master@{#27870}

Use atomic operation to read the length of a fixed array.

This fixes a race where
- mutator changes the fixed array length by trimming it,
- sweeper thread reads the length of the fixed array.

Also rename FROM_GC and FROM_MUTATOR to be more precise.

BUG=chromium:462908
LOG=NO

Review URL: https://codereview.chromium.org/1034163002

Cr-Commit-Position: refs/heads/master@{#27869}

Avoid evacuation of popular pages.

This breaks the (evacuation -> slots buffer overflow -> abort -> new GC -> evacuation) cycle for popular pages.

BUG=

Review URL: https://codereview.chromium.org/1037433002

Cr-Commit-Position: refs/heads/master@{#27868}

Revert of [x64] Use xorl to materialize smi zero. (patchset #1 id:1 of https://codereview.chromium.org/1085153002/)

Reason for revert:
Seems to cause performance regressions.

Original issue's description:
> [x64] Use xorl to materialize smi zero.
>
> Before we always loaded smi zero via a movabs with a 64-bit immediate,
> which is pretty expensive compared to the xorl.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/f236777bfe6e080ff1ead6baf847cc9b6bb4f9cb
> Cr-Commit-Position: refs/heads/master@{#27829}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:477592
LOG=n

Review URL: https://codereview.chromium.org/1059543004

Cr-Commit-Position: refs/heads/master@{#27867}

fix visiting of phantom handles that should be retained

BUG=

Review URL: https://codereview.chromium.org/1094473002

Cr-Commit-Position: refs/heads/master@{#27866}

Fix signed/unsigned compare in messages.cc

R=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1089363002

Cr-Commit-Position: refs/heads/master@{#27865}

Start migrating error message templates to the runtime.

Currently done with two templates, one used from native js, one from runtime.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1087633005

Cr-Commit-Position: refs/heads/master@{#27864}

[turbofan] Typed lowering requires typed nodes.

There's no point in checking whether a node is typed in JSTypedLowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1086303002

Cr-Commit-Position: refs/heads/master@{#27863}

[turbofan] Split ControlEquivalence implementation and add trace flag.

Split interface and implementation of ControlEquivalence and add a
dedicated trace flag --trace-turbo-ceq to make it reusable outside the
scheduler.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1056093005

Cr-Commit-Position: refs/heads/master@{#27862}

[turbofan] Make js-typed-lowering.h self contained.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1091723002

Cr-Commit-Position: refs/heads/master@{#27861}

Update V8 DEPS.

Rolling v8/tools/clang to 32e839da8bd2088ef23c3ea874d3c1cd04cd1384

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1093493002

Cr-Commit-Position: refs/heads/master@{#27860}

Revert "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"

This reverts commit 8c98cc074ef8278ce1c4dcd4790e8aaf6fbeedc6
because it causes flaky failures in the dromaeo.jslibeventprototype
benchmark on Linux/Windows and consistent failures on Android.

Also reverts the followup "Remove kForInStatementIsNotFastCase bailout reason"
(commit ba24e6769615d0ea7f7b5a31c5947769892f93a7) to avoid breaking the build.

BUG=chromium:476592
TBR=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1066663005

Cr-Commit-Position: refs/heads/master@{#27859}

Fix FormalParameterErrorLocations member names

R=arv@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1083953002

Cr-Commit-Position: refs/heads/master@{#27858}

Array() in optimized code can create with wrong ElementsKind in corner cases.

Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1086873003

Cr-Commit-Position: refs/heads/master@{#27857}

Revert of Simplify DoParseProgram (patchset #2 id:20001 of https://codereview.chromium.org/1058363003/)

Reason for revert:
[Sheriff] Changes some layout tests on all platforms, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2032/builds/2543

Original issue's description:
> Simplify DoParseProgram
>
> DoParseProgram doesn't appear to need to receive toplevel scopes as
> arguments; it can properly set the end_position of the scopes to the
> scanner's position after parsing is complete.
>
> R=marja@chromium.org
> BUG=
> LOG=N
>
> Committed: https://crrev.com/8da9252f61d3c499a78b0b94299c314b2eb0b0c8
> Cr-Commit-Position: refs/heads/master@{#27847}

TBR=marja@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1089623002

Cr-Commit-Position: refs/heads/master@{#27856}

Fix issues with name and length on poison pill function

In ES6 function name and length are configurable. However, the length
and name properties of the poison pill function must not be
configurable.

BUG=v8:4011
LOG=N
R=adamk@chromium.org, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1061393002

Cr-Commit-Position: refs/heads/master@{#27855}

Make BitsetType enum uint32_t to avoid narrowing warnings

enum defaults to signed on win, and kTagged has 1<<31 causing
warning.

Full errors:

d:\src\cr3\src\v8\src\types.cc(1259): error C2220: warning treated as error - no 'object' file generated
d:\src\cr3\src\v8\src\types.cc(1241): note: while compiling class template member function 'void v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset)'
d:\src\cr3\src\v8\src\types.cc(1283): note: see reference to function template instantiation 'void v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset)' being compiled
d:\src\cr3\src\v8\src\types.cc(1355): note: see reference to class template instantiation 'v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType' being compiled
d:\src\cr3\src\v8\src\types.cc(1259): warning C4838: conversion from 'int' to 'const v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(1259): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(323): warning C4838: conversion from '' to 'v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(323): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(315): note: while compiling class template static data member 'const v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Boundary v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::BoundariesArray[]'
d:\src\cr3\src\v8\src\types.cc(1259): warning C4838: conversion from 'int' to 'const v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(1259): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(1241): note: while compiling class template member function 'void v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset)'
d:\src\cr3\src\v8\src\types.cc(1283): note: see reference to function template instantiation 'void v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset)' being compiled
d:\src\cr3\src\v8\src\types.cc(1359): note: see reference to class template instantiation 'v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType' being compiled
d:\src\cr3\src\v8\src\types.cc(323): warning C4838: conversion from '' to 'v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(323): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(315): note: while compiling class template static data member 'const v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Boundary v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::BoundariesArray[]'

LOG=N
R=jochen@chromium.org
BUG=440500

Review URL: https://codereview.chromium.org/1055933004

Cr-Commit-Position: refs/heads/master@{#27854}

Remove operator delete on VS2015 to avoid compiler bug

LOG=N
R=jochen@chromium.org
BUG=chromium:440500

Review URL: https://codereview.chromium.org/1084763002

Cr-Commit-Position: refs/heads/master@{#27853}

Makefile: introduce debugsymbols=on flag

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1085283002

Cr-Commit-Position: refs/heads/master@{#27852}

Reduce regexp compiler stack size when not optimizing regexps

R=jkummerow@chromium.org
BUG=chromium:475705
LOG=y

Review URL: https://codereview.chromium.org/1082763002

Cr-Commit-Position: refs/heads/master@{#27851}

PPC: VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

Port c8e4d57d3b3036a05902f5b916cb5d853a57393c

Original commit message:
They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

R=mvstanton@chromium.org, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1085913003

Cr-Commit-Position: refs/heads/master@{#27850}

PPC: Use Cells to check prototype chain validity (disabled by default).

Port 0179ec57975c5063bbecd98e11cdda77ddad8996

Original commit message:
The cells are stored on prototypes (in their map's PrototypeInfo). When a prototype object changes its map, then both its own validity cell and those of all "downstream" prototypes are invalidated; handlers for a given receiver embed the currently valid cell for that receiver's prototype during their compilation and check it on execution.

R=michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1091563002

Cr-Commit-Position: refs/heads/master@{#27849}

Fix a few potential integer negation overflows

AFAICT none of these can actually be triggered currently; but it's still good to harden the code a little.

Review URL: https://codereview.chromium.org/1058533007

Cr-Commit-Position: refs/heads/master@{#27848}

Simplify DoParseProgram

DoParseProgram doesn't appear to need to receive toplevel scopes as
arguments; it can properly set the end_position of the scopes to the
scanner's position after parsing is complete.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1058363003

Cr-Commit-Position: refs/heads/master@{#27847}

[turbofan] Fix ForInStatement that deopts during filter.

This adds a missing bailout id to a ForInStatement for when retrieving
and filtering a property name deoptimizes. This can happen with proxies
that have a getPropertyDescriptor trap.

R=jarin@chromium.org
TEST=mjsunit/for-in-opt

Review URL: https://codereview.chromium.org/1086083002

Cr-Commit-Position: refs/heads/master@{#27846}

Use Cells to check prototype chain validity (disabled by default).

The cells are stored on prototypes (in their map's PrototypeInfo). When a prototype object changes its map, then both its own validity cell and those of all "downstream" prototypes are invalidated; handlers for a given receiver embed the currently valid cell for that receiver's prototype during their compilation and check it on execution.

Review URL: https://codereview.chromium.org/908213002

Cr-Commit-Position: refs/heads/master@{#27845}

VectorICs: recent changes broke cases with --novector-ics

Ensure that we protect turning off the vector ics flag.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1087213002

Cr-Commit-Position: refs/heads/master@{#27844}

[crankshaft] Add missing source position for calls.

R=verwaest@chromium.org
TEST=cctest/test-api
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1058553004

Cr-Commit-Position: refs/heads/master@{#27843}

[turbofan] cleanup ParallelMove

- make ParallelMove into a ZoneVector, removing an annoying level of indirection
- make MoveOperands hold InstructionOperands instead of pointers, so there's no more operand aliasing for moves
- opens up possibility of storing MachineType in allocated operands

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1081373002

Cr-Commit-Position: refs/heads/master@{#27842}

Retrieval of information by release channel

Polls omahaproxy for data about Chrome releases

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1063073003

Cr-Commit-Position: refs/heads/master@{#27841}

Make climit and jslimit stack limits atomic.

This fixes TSAN failure caused by race between:
 - optimizing compiler thread setting climit
 - and json parser reading climit in the main thread.

BUG=

Review URL: https://codereview.chromium.org/1031223004

Cr-Commit-Position: refs/heads/master@{#27840}

Reland "Wrap typed array implementations in functions."

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1090563002

Cr-Commit-Position: refs/heads/master@{#27839}

Abort incremental marking in test-heap/WeakCellsWithIncrementalMarking.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1089533002

Cr-Commit-Position: refs/heads/master@{#27838}

Correctly handle clearing of deprecated field types.

BUG=v8:4027
LOG=NO

Review URL: https://codereview.chromium.org/1086063003

Cr-Commit-Position: refs/heads/master@{#27837}

[turbofan] Add schedule to visualizer output

Review URL: https://codereview.chromium.org/985023002

Cr-Commit-Position: refs/heads/master@{#27836}

Put --noalways-opt flag back into regress-crbug-245480

This is a partial revert of 3eb277f270b9d41967e7ac208ec3fe8ef233761a.

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1087183002

Cr-Commit-Position: refs/heads/master@{#27835}

Revert of Force full GCwhenever CollectAllGarbage is meant to trigger a full GC. (patchset #4 id:60001 of https://codereview.chromium.org/1082973003/)

Reason for revert:
[Sheriff] Breaks http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3348 and maybe leads to timeouts/crashes on layout test bots:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064/builds/3002

Original issue's description:
> Force full GC whenever CollectAllGarbage is meant to trigger a full GC.
>
> Add a finalize incremental marking mode for CollectAllGarbage to finalize incremental marking when incremental marking is in progress, but we want a full gc at a given CollectAllGarbage call site.
>
> Default mode for CollectAllGarbage is finalize incremental marking and perform a full GC.
>
> BUG=
>
> Committed: https://crrev.com/9c105f0940ba757364ac18fcdf649815ec5ab2d1
> Cr-Commit-Position: refs/heads/master@{#27831}

TBR=ulan@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1088083002

Cr-Commit-Position: refs/heads/master@{#27834}

Remove support for specifying the number of available threads

The embedder can control how many threads it wants to use via the
v8::Platform implementation. V8 internally doesn't spin up threads
anymore. If the embedder doesn't want to use any threads at all, it's
v8::Platform implementation must either run the background jobs on
the foreground thread, or the embedder should specify --predictable

BUG=none
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1064723005

Cr-Commit-Position: refs/heads/master@{#27833}

When converting Maybe and MaybeLocal values with a check, always check

An embedder that wants to avoid the check should use MaybeLocal::ToLocal.

BUG=none
R=dcarney@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1083943002

Cr-Commit-Position: refs/heads/master@{#27832}

Force full GC whenever CollectAllGarbage is meant to trigger a full GC.

Add a finalize incremental marking mode for CollectAllGarbage to finalize incremental marking when incremental marking is in progress, but we want a full gc at a given CollectAllGarbage call site.

Default mode for CollectAllGarbage is finalize incremental marking and perform a full GC.

BUG=

Review URL: https://codereview.chromium.org/1082973003

Cr-Commit-Position: refs/heads/master@{#27831}

Added Donald Stence to PPC owners.

Review URL: https://codereview.chromium.org/1065443004

Cr-Commit-Position: refs/heads/master@{#27830}

[x64] Use xorl to materialize smi zero.

Before we always loaded smi zero via a movabs with a 64-bit immediate,
which is pretty expensive compared to the xorl.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1085153002

Cr-Commit-Position: refs/heads/master@{#27829}

Update V8 DEPS.

Rolling v8/build/gyp to 2a5511bd901f328db10d0b6415c864a5ff59fc81

Rolling v8/tools/clang to 330d3b5bd0ecf77d0d612081ba058ba01adfb67b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1091453002

Cr-Commit-Position: refs/heads/master@{#27828}

VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

This needs "Pass load ic state through the Oracle"
(https://codereview.chromium.org/1083933002/) to land first.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1083083002

Cr-Commit-Position: refs/heads/master@{#27827}

Pass load ic state through the Oracle.

We'd like to know in optimized code with more precision what feedback
state was achieved for a load.

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1083933002

Cr-Commit-Position: refs/heads/master@{#27826}

MIPS: [turbofan] Load immortal heap objects from the heap roots.

Port 5d2de78a771b8ff1ac59fbdf634bffd01709b554

BUG=

Review URL: https://codereview.chromium.org/1085693003

Cr-Commit-Position: refs/heads/master@{#27825}

Allow eval/arguments in arrow functions

R=arv@chromium.org, adamk@chromium.org, marja@chromium.org
BUG=v8:4020
LOG=N

Review URL: https://codereview.chromium.org/1061983004

Cr-Commit-Position: refs/heads/master@{#27824}

PPC: [turbofan] Load immortal heap objects from the heap roots.

Port 5d2de78a771b8ff1ac59fbdf634bffd01709b554

Original commit message:
It's cheaper to materialize heap constants by loading from the roots
array instead of embedding the constant into the instruction stream, at
least on x64, arm and arm64.

Drive-by-fix: Also cleanup the materialize constant from frame
optimization.

R=michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1075303003

Cr-Commit-Position: refs/heads/master@{#27823}

%GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present

Review URL: https://codereview.chromium.org/1086923002

Cr-Commit-Position: refs/heads/master@{#27822}

Reland "Remove support for thread-based recompilation"

Original issue's description:
> Remove support for thread-based recompilation
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/ed5db223a19dfe126af01
> Cr-Commit-Position: refs/heads/master@{#27619}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1087763003

Cr-Commit-Position: refs/heads/master@{#27821}

[cq] Add mips compile trybots.

NOTRY=true

Review URL: https://codereview.chromium.org/1051093004

Cr-Commit-Position: refs/heads/master@{#27820}

Insert a filler at the new space top even if the top is at the limit.

BUG=chromium:470390
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1066653003

Cr-Commit-Position: refs/heads/master@{#27819}

[turbofan] Load immortal heap objects from the heap roots.

It's cheaper to materialize heap constants by loading from the roots
array instead of embedding the constant into the instruction stream, at
least on x64, arm and arm64.

Drive-by-fix: Also cleanup the materialize constant from frame
optimization.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1088913002

Cr-Commit-Position: refs/heads/master@{#27818}

VectorICs: recreate feedback vector if scoping changes on recompile.

BUG=476488
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1080253003

Cr-Commit-Position: refs/heads/master@{#27817}

Revert of Reland "Remove support for thread-based recompilation" (patchset #1 id:1 of https://codereview.chromium.org/1059853004/)

Reason for revert:
still times out

Original issue's description:
> Reland "Remove support for thread-based recompilation"
>
> Original issue's description:
> > Remove support for thread-based recompilation
> >
> > BUG=v8:3608
> > R=yangguo@chromium.org
> > LOG=y
> >
> > Committed: https://crrev.com/ed5db223a19dfe126af012e894582251aa3635d7
> > Cr-Commit-Position: refs/heads/master@{#27619}
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/f1ceccb8b8b352a91e6366e3e3103f1db0df6afb
> Cr-Commit-Position: refs/heads/master@{#27813}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3608

Review URL: https://codereview.chromium.org/1082183003

Cr-Commit-Position: refs/heads/master@{#27816}

Fix Math.log10 implementation for 1 - Number.EPSILON.

R=svenpanne@chromium.org
BUG=v8:4025
LOG=N

Review URL: https://codereview.chromium.org/1084853002

Cr-Commit-Position: refs/heads/master@{#27815}

Revert "Remove early bail-out in VisitWeakList to investigate chrasher."

>  BUG=468601
>  LOG=n
>
>  Review URL: https://codereview.chromium.org/1016353002
>
>  Cr-Commit-Position: refs/heads/master@{#27317}

R=hpayer@chromium.org
BUG=v8:3996,chromium:468601
LOG=n

Review URL: https://codereview.chromium.org/1080303002

Cr-Commit-Position: refs/heads/master@{#27814}

Reland "Remove support for thread-based recompilation"

Original issue's description:
> Remove support for thread-based recompilation
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/ed5db223a19dfe126af012e894582251aa3635d7
> Cr-Commit-Position: refs/heads/master@{#27619}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1059853004

Cr-Commit-Position: refs/heads/master@{#27813}

Add a test for subclass maps.

R=arv@chromium.org

Review URL: https://codereview.chromium.org/1052963002

Cr-Commit-Position: refs/heads/master@{#27812}

Put newly allocated buffers at the right end of the buffers list

If a major gc happens between allocation and initialization of the
buffer, it might be already in old space. Since we need the list of
buffers to be sorted from new to old, we keep track of the last buffer
and put old buffers to the end

BUG=chromium:476032
R=hpayer@chromium.org,dslomov@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1079923003

Cr-Commit-Position: refs/heads/master@{#27811}

Revert of Revert of Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1083013002/)

Reason for revert:
Seems to still break those tests.

Original issue's description:
> Revert of Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1086683002/)
>
> Reason for revert:
> I don't think this is the cause.
>
> Original issue's description:
> > Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1082703003/)
> >
> > Reason for revert:
> > [Sheriff] Flaky nosnap failures:
> > http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%201/builds/1720
> > http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3312
> > http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3313
> >
> > Original issue's description:
> > > Wrap typed array implementations in functions.
> > >
> > > R=mvstanton@chromium.org
> > >
> > > Committed: https://crrev.com/6fc394a15614b74776f9bbeeb0486f430bdc8597
> > > Cr-Commit-Position: refs/heads/master@{#27784}
> >
> > TBR=mvstanton@chromium.org,yangguo@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> >
> > Committed: https://crrev.com/8e3fa7adf20f4f9c9125076a878d601eee7c9f35
> > Cr-Commit-Position: refs/heads/master@{#27789}
>
> TBR=mvstanton@chromium.org,machenbach@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/d7fe3b83f5dfa997f0c8a29436a22b999dc49a76
> Cr-Commit-Position: refs/heads/master@{#27803}

TBR=mvstanton@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1088863002

Cr-Commit-Position: refs/heads/master@{#27810}

Avoid modifying the real context chain for debug evaluation.

Instead of modifying a context chain and then modifying it back, causing
potential mismatches, we clone the inner context chain and evaluate
the expression in this cloned context. We then copy all local variable
values back if needed.

R=yangguo@chromium.org,yurys@chromium.org

Review URL: https://codereview.chromium.org/1088503003

Cr-Commit-Position: refs/heads/master@{#27809}

[turbofan] Get rid of SourcePositionInstruction.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1060373006

Cr-Commit-Position: refs/heads/master@{#27808}

X87: Disable the test case for X87 since f3338dd3b01c

  The overwrite-builtins test cases will throw one expected exception
  and the exception message should include the source position in the JS
  file. But crankshaft compiler does not generate the source position for
  it when creating the flow graph by default. The source position information
  is always zero. So it failed when comparing with the reference file.

  If we use crankshaft compiler on IA32 platform to run this test case, it
  has the same failure.

BUG=

Review URL: https://codereview.chromium.org/1086503002

Cr-Commit-Position: refs/heads/master@{#27807}

Restore V8_LIBC_UCLIBC as a libc option.

As uClibc defines __GLIBC__ in an attempt to look like glibc, V8_LIBC_GLIBC
was true for uClibc as well. Checking for uClibc before glibc fixes this
and restores the correct behavior.

BUG=

Review URL: https://codereview.chromium.org/1066573005

Cr-Commit-Position: refs/heads/master@{#27806}

fix variable shadowing

BUG=427616
LOG=N

Review URL: https://codereview.chromium.org/1087533002

Cr-Commit-Position: refs/heads/master@{#27805}

Experiment: reduce heap growing factor to investigate OOM impact.

This CL will be reverted after getting sufficient data.
BUG=

Review URL: https://codereview.chromium.org/1060533003

Cr-Commit-Position: refs/heads/master@{#27804}

Revert of Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1086683002/)

Reason for revert:
I don't think this is the cause.

Original issue's description:
> Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1082703003/)
>
> Reason for revert:
> [Sheriff] Flaky nosnap failures:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%201/builds/1720
> http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3312
> http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3313
>
> Original issue's description:
> > Wrap typed array implementations in functions.
> >
> > R=mvstanton@chromium.org
> >
> > Committed: https://crrev.com/6fc394a15614b74776f9bbeeb0486f430bdc8597
> > Cr-Commit-Position: refs/heads/master@{#27784}
>
> TBR=mvstanton@chromium.org,yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/8e3fa7adf20f4f9c9125076a878d601eee7c9f35
> Cr-Commit-Position: refs/heads/master@{#27789}

TBR=mvstanton@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1083013002

Cr-Commit-Position: refs/heads/master@{#27803}

X87: Remove unnecessary options from HTailCallThroughMegamorphicCache.

port e0844a24d35c03c6971b8beb633c3506c212179a (r27793).

original commit message:

   These options were added for a hydrogen code stub version of
the VectorIC dispatcher, which was discontinued.

BUG=

Review URL: https://codereview.chromium.org/1087573003

Cr-Commit-Position: refs/heads/master@{#27802}

X87: Change near jump to far jump to fix the jump distance check error.

  The assembler code generated by the DeoptimizeIf(...) function under X87 is larger
  and the  distance between the link point and the bind point which has two DeoptimizeIf()
  is larger then near link distance (127) for labels.

BUG=

Review URL: https://codereview.chromium.org/1065893003

Cr-Commit-Position: refs/heads/master@{#27801}

MIPS: Split TemplateHashMapImpl::Lookup into two methods.

Port 5277c41044d94ce6452e5fcf6ed703d6c1dcfe4b.

BUG=

Review URL: https://codereview.chromium.org/1084723003

Cr-Commit-Position: refs/heads/master@{#27800}

Split TemplateHashMapImpl::Lookup into two methods

This avoids both a mysterious boolean argument ("insert") and lets
non-mutating lookups skip passing an allocator (in one such case,
we were passing a scary-looking ZoneAllocationPolicy(NULL)!).

Review URL: https://codereview.chromium.org/1074943002

Cr-Commit-Position: refs/heads/master@{#27799}

[es6] Fix length property of collection constructors

{Map, Set, WeakMap, WeakSet}.length should be 0.

BUG=v8:4021
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1073233002

Cr-Commit-Position: refs/heads/master@{#27798}

PPC: Remove unnecessary options from HTailCallThroughMegamorphicCache

Port e0844a24d35c03c6971b8beb633c3506c212179a

Original commit message:
These options were added for a hydrogen code stub version of
the VectorIC dispatcher, which was discontinued.

R=mvstanton@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1088573002

Cr-Commit-Position: refs/heads/master@{#27797}

[strong] Implement static restrictions on direct eval

Does not entirely disallow the use of 'eval' as an identifier in strong mode,
as originally proposed.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1059273004

Cr-Commit-Position: refs/heads/master@{#27796}

Fix indirect push

BUG=chromium:388665
LOG=n

Review URL: https://codereview.chromium.org/1087463003

Cr-Commit-Position: refs/heads/master@{#27795}

PPC: Fix NaN Canonicalization.

Use fsub rather than fadd to avoid stripping the sign from minus zero.

Fixes mjsunit/result-table-min and mjsunit/result-table-max test failures.

R=michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1084583003

Cr-Commit-Position: refs/heads/master@{#27794}

Remove unnecessary options from HTailCallThroughMegamorphicCache

These options were added for a hydrogen code stub version of
the VectorIC dispatcher, which was discontinued.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1081883002

Cr-Commit-Position: refs/heads/master@{#27793}

[turbofan] Optimize loads of global constants in JSTypedLowering.

R=mstarzinger@chromium.org,verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1077343002

Cr-Commit-Position: refs/heads/master@{#27792}

Revert "ES6: Number and Boolean prototype should be ordinary objects"

This reverts commit e965a1f84a7a4024d40680ef63e82abeaef867fd.

The reason is that it breaks jsfiddle.com

BUG=476437, v8:4001
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1086673002

Cr-Commit-Position: refs/heads/master@{#27791}

Revert of VectorICs: megamorphic keyed loads in crankshaft don't need a vector. (patchset #3 id:40001 of https://codereview.chromium.org/1067573003/)

Reason for revert:
[Sheriff] Speculative revert for windows failure... will reland if it doesn't help:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug%20-%202/builds/2891

Original issue's description:
> VectorICs: megamorphic keyed loads in crankshaft don't need a vector.
>
> They are content with a dummy vector, as MISSES won't result in
> changing the real vector/slot at all.
>
> BUG=
>
> Committed: https://crrev.com/c8e4d57d3b3036a05902f5b916cb5d853a57393c
> Cr-Commit-Position: refs/heads/master@{#27788}

TBR=dcarney@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1060263003

Cr-Commit-Position: refs/heads/master@{#27790}

Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1082703003/)

Reason for revert:
[Sheriff] Flaky nosnap failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%201/builds/1720
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3312
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3313

Original issue's description:
> Wrap typed array implementations in functions.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/6fc394a15614b74776f9bbeeb0486f430bdc8597
> Cr-Commit-Position: refs/heads/master@{#27784}

TBR=mvstanton@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1086683002

Cr-Commit-Position: refs/heads/master@{#27789}

VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

BUG=

Review URL: https://codereview.chromium.org/1067573003

Cr-Commit-Position: refs/heads/master@{#27788}

[turbofan] remove register operand cache

BUG=

Review URL: https://codereview.chromium.org/1085623002

Cr-Commit-Position: refs/heads/master@{#27787}

collect phantom handle data before it gets overwritten

R=jochen@chromium.org, hpayer@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1064713005

Cr-Commit-Position: refs/heads/master@{#27786}

[turbofan] cleanup PointerMap

rename to ReferenceMap
use ZoneVector for storage
drop dead code

BUG=

Review URL: https://codereview.chromium.org/1081053002

Cr-Commit-Position: refs/heads/master@{#27785}

Wrap typed array implementations in functions.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1082703003

Cr-Commit-Position: refs/heads/master@{#27784}

Remove kForInStatementIsNotFastCase bailout reason

BUG=

Review URL: https://codereview.chromium.org/1081803002

Cr-Commit-Position: refs/heads/master@{#27783}

Expose ArrayBufferView::HasBuffer

This allows the embedder to decide whether it's worthwhile to copy the
contents to avoid materializing a buffer.

BUG=v8:3996
R=dslomov@chromium.org,kbr@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1084513002

Cr-Commit-Position: refs/heads/master@{#27782}