Don't apply pointer multipler to heap sizes on Android.

Android doesn't have swap space so if the heap goes over the physical memory
size the system will just kill us. Applying the Heap::kPointerMultipler
to heap size could cause the max heap size to be larger than physical memory.
Instead use the defaults which are based on actual physical memory configured
by Api::ConfigureDefaults().

BUG=432909
LOG=N

Review URL: https://codereview.chromium.org/960213007

Cr-Commit-Position: refs/heads/master@{#26954}

CpuProfiler: do not calculate positions if it is not necessary (TryInline part).

TryInline needed position only for the case when we track positions.
We can drop the position argument and use the current position from GraphBuilder.
The only problem that it doesn't match with the inline point.
The reason of that was the fact that builder had moved the position forward by
visiting arguments expressions.

I fixed this by restoring the current positon in HOptimizedGraphBuilderWithPositions::Visit*

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/962593005

Cr-Commit-Position: refs/heads/master@{#26953}

convert more object functions to return maybes

R=svenpanne@chromium.org

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/972623003

Cr-Commit-Position: refs/heads/master@{#26952}

Contribution of PowerPC port (continuation of 422063005) - currency

Contribution of PowerPC port (continuation of 422063005, 817143002,
866843003, and 901083004. This patch updates the ppc directories
to make them current with changes in common code, removes the
optimization to use the ool constant pool, and excludes tests that
don't pass under the ppc simulator given a 240s timeout.

Subsequent patches will cover:
   - remaining optimizations for PPC
   - remaining AIX changes not resolved by 4.8 compiler (4.8 is only recently available for AIX)
   - incremental updates required to ppc directories due to platform specific changes made
    in google repos while we complete the above steps.

modified:   src/compiler/ppc/code-generator-ppc.cc
modified:   src/ic/ppc/handler-compiler-ppc.cc
modified:   src/ppc/assembler-ppc-inl.h
modified:   src/ppc/assembler-ppc.cc
modified:   src/ppc/assembler-ppc.h
modified:   src/ppc/builtins-ppc.cc
modified:   src/ppc/code-stubs-ppc.cc
modified:   src/ppc/debug-ppc.cc
modified:   src/ppc/deoptimizer-ppc.cc
modified:   src/ppc/frames-ppc.cc
modified:   src/ppc/frames-ppc.h
modified:   src/ppc/full-codegen-ppc.cc
modified:   src/ppc/lithium-codegen-ppc.cc
modified:   src/ppc/lithium-ppc.cc
modified:   src/ppc/lithium-ppc.h
modified:   src/ppc/macro-assembler-ppc.cc
modified:   src/ppc/macro-assembler-ppc.h
modified:   test/cctest/cctest.status
modified:   test/mjsunit/mjsunit.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/965823002

Cr-Commit-Position: refs/heads/master@{#26951}

[x64] Use movaps instead of movsd for the move between double registers.

Review URL: https://codereview.chromium.org/972053002

Cr-Commit-Position: refs/heads/master@{#26950}

[turbofan] Fix ControlFlowOptimizer to also handle non-control nodes in the control chain.

Review URL: https://codereview.chromium.org/971223002

Cr-Commit-Position: refs/heads/master@{#26949}

X87: Prefill with correct contextual load ICs in fullcodegen.

port 7ee31a2348c67ee09664519818c8feb61c82fedf (r26941).

original commit message:

  Compute correct contextual load ICs in fullcodegen.

BUG=

Review URL: https://codereview.chromium.org/974483005

Cr-Commit-Position: refs/heads/master@{#26948}

Tweak memory management in the serializer.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/957703003

Cr-Commit-Position: refs/heads/master@{#26947}

MIPS: Compute correct contextual load ICs in fullcodegen.

Port 7ee31a2348c67ee09664519818c8feb61c82fedf

BUG=
R=dusan.milosavljevic@imgtec.com

Review URL: https://codereview.chromium.org/969803002

Cr-Commit-Position: refs/heads/master@{#26946}

fix webkit tests

r26943 just moved the problem around

TBR=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/963023003

Cr-Commit-Position: refs/heads/master@{#26945}

[turbofan] Normalize union of representation and range to a range.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/972543003

Cr-Commit-Position: refs/heads/master@{#26944}

check for null context on execution entry

blink is incorrectly calling api functions without a context.  we need this to find those places

R=svenpanne@chromium.org

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/968943002

Cr-Commit-Position: refs/heads/master@{#26943}

[turbofan] Strength reduction of Word32And with Int32Mul.

- (x * (K << L)) & (-1 << L) => x * (K << L)
- ((K << L) * x) & (-1 << L) => x * (K << L)

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/972653002

Cr-Commit-Position: refs/heads/master@{#26942}

Compute correct contextual load ICs in fullcodegen.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/969733003

Cr-Commit-Position: refs/heads/master@{#26941}

convert object::* to return maybe values

BUG=v8:3929
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/971693002

Cr-Commit-Position: refs/heads/master@{#26940}

[turbofan] Use the typer to statically detect Smis.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/968773004

Cr-Commit-Position: refs/heads/master@{#26939}

[turbofan] Fix deferred replacement in simplified lowering.

Deferred replacement must also replace in the pending node vector.

BUG=chromium:463056
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/966423002

Cr-Commit-Position: refs/heads/master@{#26938}

Removed funky Maybe constructor and made fields private.

BUG=v8:3929
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/958053003

Cr-Commit-Position: refs/heads/master@{#26937}

Polish Maybe API a bit, removing useless creativity and fixing some signatures.

BUG=v8:3929
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/967243002

Cr-Commit-Position: refs/heads/master@{#26936}

[x86] Improve code generation for context materialization.

On Intel targets, it is cheaper to load the context from the frame
instead of loading the context as a constant (which usually involves a
PropertyCell because the context is in new space when we compile the
function).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/970803002

Cr-Commit-Position: refs/heads/master@{#26935}

[turbofan] Skip write barriers when storing smi.

On 64-bit targets, we can skip the write barrier for Store nodes if the
input is ChangeInt32ToTagged, because the value being stored is
definitely represented as a smi then.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/968113002

Cr-Commit-Position: refs/heads/master@{#26934}

Revert of ES6: Make function name configurable (patchset #10 id:220001 of https://codereview.chromium.org/960343002/)

Reason for revert:
Breaks Chrome browser test that checks Object.name

[16509:16509:0228/030150:INFO:CONSOLE(43)] "Uncaught Error: Clobbered Object.name getter", source: http://www.chromium.org:33611/assertions.js (43)

http://build.chromium.org/p/client.v8/builders/Linux%20Tests%20%28dbg%29%281%29/builds/2328/steps/browser_tests/logs/stdio

Original issue's description:
> ES6: Make function name configurable
>
> This is partially based on r21609 but that CL was incomplete.
>
> Function name is still non writable so one has to use defineProperty
> to change the actual value.
>
> BUG=v8:3333
> LOG=N
> R=adamk, mstarzinger@chromium.org
>
> Committed: https://crrev.com/f7790f7670c8d859455a98fcb90ff1b66af1eca7
> Cr-Commit-Position: refs/heads/master@{#26924}

TBR=adamk@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3333

Review URL: https://codereview.chromium.org/969683002

Cr-Commit-Position: refs/heads/master@{#26933}

X87: Disallow subclassing Arrays.

port 290ee378ea44bda379cb3e1864631895c7dea774 (r26931).

original commit message:

UG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/963393002

Cr-Commit-Position: refs/heads/master@{#26932}

Disallow subclassing Arrays.

R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3930
LOG=Y

Committed: https://crrev.com/87f3e08e72510ee5544e82bb7ad39b2b5f001ad3
Cr-Commit-Position: refs/heads/master@{#26925}

Review URL: https://codereview.chromium.org/962263002

Cr-Commit-Position: refs/heads/master@{#26931}

Revert of Disallow subclassing Arrays. (patchset #3 id:40001 of https://codereview.chromium.org/962263002/)

Reason for revert:
Fails on nosnap build

Original issue's description:
> Disallow subclassing Arrays.
>
> R=rossberg@chromium.org,arv@chromium.org
> BUG=v8:3930
> LOG=Y
>
> Committed: https://crrev.com/87f3e08e72510ee5544e82bb7ad39b2b5f001ad3
> Cr-Commit-Position: refs/heads/master@{#26925}

TBR=arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3930

Review URL: https://codereview.chromium.org/965053002

Cr-Commit-Position: refs/heads/master@{#26930}

Revert of Regression test for v8:3930. (patchset #1 id:1 of https://codereview.chromium.org/961353002/)

Reason for revert:
Fails on nosnap builds

Original issue's description:
> Regression test for v8:3930.
>
> R=arv@chromium.org,rossberg@chromium.org
> BUG=v8:3930
> LOG=N
>
> Committed: https://crrev.com/48fb3e83c5882e9818bc1e0a035864b465602aca
> Cr-Commit-Position: refs/heads/master@{#26926}

TBR=arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3930

Review URL: https://codereview.chromium.org/965043002

Cr-Commit-Position: refs/heads/master@{#26929}

Make the auto-pusher recover easier.

The auto-push script is only used in an automated fashion
on bots. It doesn't need to check for a clean git
environment as it has a special workdir checkout.

If the release creation fails for whatever reason (e.g.
a master restart happens in the middle), the workdir
checkout might be left dirty. Any new attempt of the auto
pusher then bails out.

After this change it will call the create_release script
in any case which tidies up the workspace on startup.

TBR=tandrii@chromium.org
NOTRY=true
TEST=./script_test.py

Review URL: https://codereview.chromium.org/960773007

Cr-Commit-Position: refs/heads/master@{#26928}

Fix block-for test

The test didn't call the test function.

BUG=v8:3932
LOG=N
TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/964993002

Cr-Commit-Position: refs/heads/master@{#26927}

Regression test for v8:3930.

R=arv@chromium.org,rossberg@chromium.org
BUG=v8:3930
LOG=N

Review URL: https://codereview.chromium.org/961353002

Cr-Commit-Position: refs/heads/master@{#26926}

Disallow subclassing Arrays.

R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3930
LOG=Y

Review URL: https://codereview.chromium.org/962263002

Cr-Commit-Position: refs/heads/master@{#26925}

ES6: Make function name configurable

This is partially based on r21609 but that CL was incomplete.

Function name is still non writable so one has to use defineProperty
to change the actual value.

BUG=v8:3333
LOG=N
R=adamk, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/960343002

Cr-Commit-Position: refs/heads/master@{#26924}

Remove trailing enum comma, I see arm compile failures due to this

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/961263002

Cr-Commit-Position: refs/heads/master@{#26923}

Stage ES6 computed property names

BUG=v8:3754
LOG=N
R=dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/959313002

Cr-Commit-Position: refs/heads/master@{#26922}

Create ImportDeclarations for default imports.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/958213006

Cr-Commit-Position: refs/heads/master@{#26921}

Allow lookup of module exports by export name.

This required fixing the exports_ hash map to use the appropriate
comparison function instead of pointer comparison.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/960793003

Cr-Commit-Position: refs/heads/master@{#26920}

Avoid repeating code when creating builtins.

InstallBuiltinFunctionIds stood out when looking at code that grew
strangely when compiled with default optimizations.

This change from repeated code to a loop saves 6-7 KB of machine code.
I suspect it's faster but I also suspect it's fast enough either way so
that is not really a factor. Machine code reduction seen below.

Code formatted with git cl format.

clang x64:
Total change: -5985 bytes
-------------------------------------------
 +517 - Source: ?? - (gained 744, lost 227)
-------------------------------------------
  New symbols:
       +744: v8::internal::Genesis::InstallBuiltinFunctionIds()::builtins type=d, size=744 bytes
  Removed symbols:
         -4: .L.str98 type=r, size=4 bytes
... [stripped 30 similar lines]
        -19: .L.str100 type=r, size=19 bytes

----------------------------------------------------------------------------------------------
 -6502 - Source: /home/bratell/src/chromium/src/v8/src/bootstrapper.cc - (gained 0, lost 6502)
----------------------------------------------------------------------------------------------
  Removed symbols:
      -1135: v8::internal::ResolveBuiltinIdHolder(v8::internal::Handle<v8::internal::Context>, char const*) type=t, size=1135 bytes
  Shrunk symbols:
      -5367: v8::internal::Genesis::InstallBuiltinFunctionIds() type=t, (was 7105 bytes, now 1738 bytes)

BUG=

Review URL: https://codereview.chromium.org/918303005

Cr-Commit-Position: refs/heads/master@{#26919}

Update V8 DEPS.

Rolling v8/buildtools to 93b3d0af1b30db55ee42bd2e983f7753153217db

Rolling v8/tools/clang to eb87c73202018d13f2f713e1304ab4edf9a6f49f

TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/962223002

Cr-Commit-Position: refs/heads/master@{#26918}

Fix for mips64 after #26916

BUG=
TBR=svenpanne

Review URL: https://codereview.chromium.org/960903005

Cr-Commit-Position: refs/heads/master@{#26917}

CpuProfiler: replace raw position with SourcePosition for DeoptReason

Save Unknown position as zero in RelocInfo.
Remove copy constructor of SourcePosition because it is trivial.
Mechanical replace int raw_position with SourcePosition position.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/959203002

Cr-Commit-Position: refs/heads/master@{#26916}

ensure host compiler is always clang when cross compiling from linux

BUG=

Committed: https://crrev.com/56039af476797accc238dcb24c7ab926899287a0
Cr-Commit-Position: refs/heads/master@{#26881}

Review URL: https://codereview.chromium.org/955393002

Cr-Commit-Position: refs/heads/master@{#26915}

convert Value::*Value() function to return Maybe results

BUG=v8:3929
LOG=Y

Review URL: https://codereview.chromium.org/959223002

Cr-Commit-Position: refs/heads/master@{#26914}

Remove obsolete Isolate::DoThrow helper.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/967483003

Cr-Commit-Position: refs/heads/master@{#26913}

Convert v8::Value::To* to use MaybeLocal

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/962983002

Cr-Commit-Position: refs/heads/master@{#26912}

[turbofan] Avoid generating dead BooleanNot nodes in typed lowering.

Without this shortcut we generate one BooleanNot per JSUnaryNot with
number input, which is quite common in asm.js. These dead nodes then
survive until the late control reducer runs, and may prevent
optimizations in the mean time.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/963713002

Cr-Commit-Position: refs/heads/master@{#26911}

[turbofan] Properly unlink dead nodes in simplified lowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/964843002

Cr-Commit-Position: refs/heads/master@{#26910}

MIPS: Skip the mapcheck on the global object since the global proxy and cell are already checked (or the global object map for contextual global loads).

Port 6af7ca6be4cd768b3326f0b8c32d4fbc3baa20c8

BUG=

Review URL: https://codereview.chromium.org/957393002

Cr-Commit-Position: refs/heads/master@{#26909}

X87: Skip the mapcheck on the global object since the global proxy and cell are already checked

port 6af7ca6be4cd768b3326f0b8c32d4fbc3baa20c8 (r26886)

original commit message:

  Skip the mapcheck on the global object since the global proxy and cell are already
  checked (or the global object map for contextual global loads).

BUG=

Review URL: https://codereview.chromium.org/965693002

Cr-Commit-Position: refs/heads/master@{#26908}

[x64] Make r12 allocatable.

Review URL: https://codereview.chromium.org/926553004

Cr-Commit-Position: refs/heads/master@{#26907}

Add the corresponding change for turbofan unsupported port.

 this is introduced by 88c4f52cb27474989a646d6c9433bbab3e55f8ae (r26783)

BUG=

Review URL: https://codereview.chromium.org/958243004

Cr-Commit-Position: refs/heads/master@{#26906}

X87: Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.

port e9cdcb71743200e7dd18b0be62f764aa53729c63 (r26875)

original commit message:
  Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.
  Proxies up the chain are guaranteed to provide access if we had access to the receiver,
  since otherwise we wouldn't have been able to compile the stub in the first place.
  If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/964813002

Cr-Commit-Position: refs/heads/master@{#26905}

X87: Move Maps' back pointers from "transitions" to "constructor" field.

port affcfaf42801414d25b3e57271a9803a026f40ed (r26835).

original commit message:

  Move Maps' back pointers from "transitions" to "constructor" field

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/964783002

Cr-Commit-Position: refs/heads/master@{#26904}

X87: Stop using HeapType in IC and Crankshaft.

port 119cb5661724006b736fcb6484258c752125e372 (r26696).

original commit message:

  Stop using HeapType in IC and Crankshaft

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/958283002

Cr-Commit-Position: refs/heads/master@{#26903}

Test StringLengthStub generation via TurboFan.

For now we just use the RawMachineAssembler, this will be changed
later to use the whole TurboFan pipeline.

Review URL: https://codereview.chromium.org/925373002

Cr-Commit-Position: refs/heads/master@{#26902}

Add the dummy implementation for turbofan unsupported port.

  This is introduced by acd9c46ca7a0ada723d717f2545fd484c824eaa2 (r26691).

BUG=

Review URL: https://codereview.chromium.org/965673002

Cr-Commit-Position: refs/heads/master@{#26901}

Revert of Also skip when the target is the global object (patchset #1 id:1 of https://codereview.chromium.org/961723002/)

Reason for revert:
Breaks unscopables and fix attempt needed to be reverted too.

Original issue's description:
> Also skip when the target is the global object
>
> BUG=
>
> Committed: https://crrev.com/cc918d30b9d586ce974b71232473f2ae3c5e7847
> Cr-Commit-Position: refs/heads/master@{#26887}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/960363002

Cr-Commit-Position: refs/heads/master@{#26900}

Revert of Invalidate the global property cell when converting from data to accessor. (patchset #1 id:1 of https://codereview.chromium.org/961003002/)

Reason for revert:
Breaks gc stress, e.g.: http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%201/builds/2322

Original issue's description:
> Invalidate the global property cell when converting from data to accessor.
>
> BUG=
> TBR=jkummerow@chromium.org,
>
> Committed: https://crrev.com/6a12dc240b1faffa500ff269077d832ecc74239d
> Cr-Commit-Position: refs/heads/master@{#26896}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/958113004

Cr-Commit-Position: refs/heads/master@{#26899}

Revert of MIPS: Also skip when the target is the global object. (patchset #1 id:1 of https://codereview.chromium.org/957413002/)

Reason for revert:
Need to revert the ported CL.

Original issue's description:
> MIPS: Also skip when the target is the global object.
>
> Port cc918d30b9d586ce974b71232473f2ae3c5e7847
>
> BUG=
>
> Committed: https://crrev.com/b24a0efa447235e11b9ff9d1eeaada06131b2e04
> Cr-Commit-Position: refs/heads/master@{#26897}

TBR=danno@chromium.org,verwaest@chromium.org,paul.lind@imgtec.com,gergely.kis@imgtec.com,akos.palfi@imgtec.com,dusan.milosavljevic@imgtec.com,balazs.kilvady@imgtec.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/963603002

Cr-Commit-Position: refs/heads/master@{#26898}

MIPS: Also skip when the target is the global object.

Port cc918d30b9d586ce974b71232473f2ae3c5e7847

BUG=

Review URL: https://codereview.chromium.org/957413002

Cr-Commit-Position: refs/heads/master@{#26897}

Invalidate the global property cell when converting from data to accessor.

BUG=
TBR=jkummerow@chromium.org,

Review URL: https://codereview.chromium.org/961003002

Cr-Commit-Position: refs/heads/master@{#26896}

Re-introduce ImportDeclaration to the parser

This also adds a new VariableMode, IMPORT, which will be
used to do appropriate binding for Import-declared Variables.

Only named imports are handled for now. "import *" and default
import syntaxes have had their TODOs adjusted to match the new
code structure.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/948303004

Cr-Commit-Position: refs/heads/master@{#26895}

MIPS: Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.

Port e9cdcb71743200e7dd18b0be62f764aa53729c63

Original commit message:
Proxies up the chain are guaranteed to provide access if we had access to the receiver, since otherwise we wouldn't have been able to compile the stub in the first place. If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=

Review URL: https://codereview.chromium.org/958923002

Cr-Commit-Position: refs/heads/master@{#26894}

Revert "Revert of Fix memory leak caused by field type in descriptor array."

This reverts commit b57be748b175695be2507cedf3423b59b9d6cd20 and
disables the test/mjsunit/debug-clearbreakpointgroup.js because
BreakLocationIterator::ClearBreakPoint is already broken for unrelated reasons (see v8:3924).

BUG=v8:3877
LOG=N
TEST=cctest/test-heap/Regress3877

Review URL: https://codereview.chromium.org/957373002

Cr-Commit-Position: refs/heads/master@{#26893}

Fix issue with class name TDZ in computed property names

BUG=v8:3923
LOG=N
R=marja,rossberg

Review URL: https://codereview.chromium.org/961823002

Cr-Commit-Position: refs/heads/master@{#26892}

Store weak cell cache for map in the map itself.

BUG=

Review URL: https://codereview.chromium.org/958023002

Cr-Commit-Position: refs/heads/master@{#26891}

Remove RecordTypeFeedback() methods from some AST classes and move into typing.cc.

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/955243002

Cr-Commit-Position: refs/heads/master@{#26890}

Fix memory leak in natives-external.

(Discovered when landing crrev.com/959693002)

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/960883003

Cr-Commit-Position: refs/heads/master@{#26889}

MIPS64: Optimize generated code size for deoptimization table entry.

Reuse optimization introduced in 6dee8884.

TEST=
BUG=

Review URL: https://codereview.chromium.org/960963002

Cr-Commit-Position: refs/heads/master@{#26888}

Also skip when the target is the global object

BUG=

Review URL: https://codereview.chromium.org/961723002

Cr-Commit-Position: refs/heads/master@{#26887}

Skip the mapcheck on the global object since the global proxy and cell are already checked (or the global object map for contextual global loads).

BUG=

Review URL: https://codereview.chromium.org/961693002

Cr-Commit-Position: refs/heads/master@{#26886}

Revert of Default-enable external startup data for Linux for stand-alone builds. (patchset #1 id:1 of https://codereview.chromium.org/959693002/)

Reason for revert:
Breaks "Simple Leaks Check"

Original issue's description:
> Default-enable external startup data for Linux for stand-alone builds.
>
> Notes:
> - Other platforms to follow later.
> - This follows Chromium practice, that mostly uses this feature these days.
> - The statically linked-in startup data will stay. So whoever prefers
>   the old way just needs to set the flag differently.
>
> BUG=
>
> Committed: https://crrev.com/6d0dcaabe55ca3556bebfd771fbc7fd560fdd4e0
> Cr-Commit-Position: refs/heads/master@{#26884}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/962593003

Cr-Commit-Position: refs/heads/master@{#26885}

Default-enable external startup data for Linux for stand-alone builds.

Notes:
- Other platforms to follow later.
- This follows Chromium practice, that mostly uses this feature these days.
- The statically linked-in startup data will stay. So whoever prefers
  the old way just needs to set the flag differently.

BUG=

Review URL: https://codereview.chromium.org/959693002

Cr-Commit-Position: refs/heads/master@{#26884}

Revert of Fix memory leak caused by field type in descriptor array. (patchset #3 id:40001 of https://codereview.chromium.org/955063002/)

Reason for revert:
Breaks test/mjsunit/debug-clearbreakpointgroup.js on arm64.debug.

Original issue's description:
> Fix memory leak caused by field type in descriptor array.
>
> When a field type is a map, it is wrapped in a weak cell upon storing to the descriptor array.
>
> Map::GetFieldType(i) does the unwrapping.
>
> BUG=v8:3877
> LOG=N
> TEST=cctest/test-heap/Regress3877
>
> Committed: https://crrev.com/77d3ae0e119893ac8d34ea6ca090cddd5bbf987e
> Cr-Commit-Position: refs/heads/master@{#26879}

TBR=verwaest@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3877

Review URL: https://codereview.chromium.org/960103003

Cr-Commit-Position: refs/heads/master@{#26883}

Revert of ensure host compiler is always clang when cross compiling from linux (patchset #6 id:100001 of https://codereview.chromium.org/955393002/)

Reason for revert:
broke some things

Original issue's description:
> ensure host compiler is always clang when cross compiling from linux
>
> BUG=
>
> Committed: https://crrev.com/56039af476797accc238dcb24c7ab926899287a0
> Cr-Commit-Position: refs/heads/master@{#26881}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/964483002

Cr-Commit-Position: refs/heads/master@{#26882}

ensure host compiler is always clang when cross compiling from linux

BUG=

Review URL: https://codereview.chromium.org/955393002

Cr-Commit-Position: refs/heads/master@{#26881}

[strong] Declaration-after-use errors.

We cannot yet detect use-before-declaration in general, because for that we'd
need to analyze the context when compiling. But we can detect an error case
where we first see a use, then a declaration.

For this, I also added end position tracking (needed for error messages) to
VariableProxy.

Note: the position naming is completely inconsistent: start_position &
end_position, position & end_position, pos & end_pos, beg_pos & end_pos, to name
a few. This doesn't fix all of it, but tries to unify towards start_position &
end_position whenever possible w/ minimal changes.

BUG=

Review URL: https://codereview.chromium.org/943543002

Cr-Commit-Position: refs/heads/master@{#26880}

Fix memory leak caused by field type in descriptor array.

When a field type is a map, it is wrapped in a weak cell upon storing to the descriptor array.

Map::GetFieldType(i) does the unwrapping.

BUG=v8:3877
LOG=N
TEST=cctest/test-heap/Regress3877

Review URL: https://codereview.chromium.org/955063002

Cr-Commit-Position: refs/heads/master@{#26879}

Don't perform access checks for internally used properties

BUG=
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/956283003

Cr-Commit-Position: refs/heads/master@{#26878}

Make landmines delete all generated build artifacts.

BUG=chromium:403263
LOG=n

Review URL: https://codereview.chromium.org/963433002

Cr-Commit-Position: refs/heads/master@{#26877}

Revert of Temporarily disable double fields unboxing. (patchset #1 id:1 of https://codereview.chromium.org/928733003/)

Reason for revert:
Preparing to land a fix.

Original issue's description:
> Temporarily disable double fields unboxing.
>
> Committed: https://crrev.com/209cf09ac9e36c1a24cdfa918bc579a4671c6842
> Cr-Commit-Position: refs/heads/master@{#26727}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/960173002

Cr-Commit-Position: refs/heads/master@{#26876}

Only dynamically perform access checks on the receiver if it's a JSGlobalProxy. Proxies up the chain are guaranteed to provide access if we had access to the receiver, since otherwise we wouldn't have been able to compile the stub in the first place. If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=

Review URL: https://codereview.chromium.org/958843002

Cr-Commit-Position: refs/heads/master@{#26875}

Remove internal use of v8::AccessType, always pass v8::ACCESS_HAS instead.

BUG=

Review URL: https://codereview.chromium.org/942963004

Cr-Commit-Position: refs/heads/master@{#26874}

Add public version macros.

Side note: tools/v8-info.sh seems to have been broken ever
since the move to git.  At least it's not more broken now.

BUG=v8:3075
LOG=y

TEST=./script_test.py

Review URL: https://codereview.chromium.org/959713003

Cr-Commit-Position: refs/heads/master@{#26873}

Do not touch a binary op IC target in code object marked for lazy deopt.

Bad scenario:

- Enter a binop IC miss handler from optimized code object C from call
  site S,

- From the binop IC, invoke arbitrary javascript that lazy deopts C,
  so all relocation info is nuked and replaced with lazy deopt entries'
  reloc info. In particular, there is no reloc info for S.

- Still from the arbitrary JavaScript, make IC target's code object move.
  Note that the call site S is not updated.

- Return to the miss handler and inspect the IC's target. This will try
  to get the target from S, but that is a potentially invalid pointer.

It is quite possible that we will have to do a similar fix for other ICs,
but we will have to find a reliable repro first. I am not submitting a
repro here because it is quite long running and brittle (it
relies on code compaction happening while in the binop IC).

BUG=v8:3910
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/958473004

Cr-Commit-Position: refs/heads/master@{#26872}

[gyp] Disable warnings generated by third party ICU code.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/962523002

Cr-Commit-Position: refs/heads/master@{#26871}

[turbofan] Fix bogus covering of Word64Equal w/ zero.

Review URL: https://codereview.chromium.org/960783002

Cr-Commit-Position: refs/heads/master@{#26870}

Minor test fix to block binding

The test did not invoke the function

BUG=v8:3921
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/961463002

Cr-Commit-Position: refs/heads/master@{#26869}

Rename ParseModule to ParseModuleItemList

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/952343002

Cr-Commit-Position: refs/heads/master@{#26868}

Remove NativeContext from Literal array, since we always create the literals in the native context of the current closure.

BUG=

Review URL: https://codereview.chromium.org/952303002

Cr-Commit-Position: refs/heads/master@{#26867}

[turbofan] change tracing in scheduler so block_id is id: instead of B and rpo_number is now B

R=mstarzinger@chromium.org

BUG=

Review URL: https://codereview.chromium.org/948263004

Cr-Commit-Position: refs/heads/master@{#26866}

No need for special treatment of super in PreParserExpression

It turned out that we didn't need to treat super in a special way
in the pre parser expressions.

BUG=None
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/952283003

Cr-Commit-Position: refs/heads/master@{#26865}

Remove ValidateSuperCall

We don't need this since this case is now a SyntaxError.

BUG=None
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/957823002

Cr-Commit-Position: refs/heads/master@{#26864}

Simplify error message logic in ParseImportNames

The new logic ensures that the error messages are the same in the
"import { <reserved word> }" and "import { foo as <reserved ord> }"
cases.

Also prepares ParseImportNames for returning both the import and local
names to ParseImportClause.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/952863006

Cr-Commit-Position: refs/heads/master@{#26863}

emit premonomorphic ics for keyed loads/stores in optimized code

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/945313003

Cr-Commit-Position: refs/heads/master@{#26862}

MIPS64: Improve and fix hole nan checks and canonicalization.

TEST=kraken-1.1 benchmark
BUG=

Review URL: https://codereview.chromium.org/952233002

Cr-Commit-Position: refs/heads/master@{#26861}

MIPS: Fix 'MIPS: Move Maps' back pointers from "transitions" to "constructor" field'.

BUG=

Review URL: https://codereview.chromium.org/950523003

Cr-Commit-Position: refs/heads/master@{#26860}

[turbofan] remove dependence of InstructionBlock on BasicBlock

BUG=

Review URL: https://codereview.chromium.org/951553005

Cr-Commit-Position: refs/heads/master@{#26859}

Rebase GDBJIT interface solely on JITCodeEvent

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/958623002

Cr-Commit-Position: refs/heads/master@{#26858}

Remove effectful assertion

R=mstarzinger@chromium.org
BUG=461520
LOG=N

Review URL: https://codereview.chromium.org/955973003

Cr-Commit-Position: refs/heads/master@{#26857}

Make ComputeReceiverForNonGlobal faster

by checking instance type rather than constructor.

BUG=chromium:461734
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/953283004

Cr-Commit-Position: refs/heads/master@{#26856}

Add v8::Object::GetRealNamedPropertyAttributes()

Add v8::Object::GetRealNamedPropertyAttributes() and
v8::Object::GetRealNamedPropertyAttributesInPrototypeChain().

See https://github.com/iojs/io.js/issues/864 for background.

Review URL: https://codereview.chromium.org/942003003

Cr-Commit-Position: refs/heads/master@{#26855}