Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

Use the LookupIterator in SetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}

Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.

@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}

Remove GetAttributes from the mix to avoid another virtual dispatch.

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1175973002

Cr-Commit-Position: refs/heads/master@{#28953}

X87:  [strong] Refactor ObjectStrength into a replacement for strong boolean args

port dd8544495109804c632bfbcefc3c5c701e0a8c43 (r28839)

original commit message:

    Boolean "is_strong" parameters have begun to proliferate across areas where
    strong mode semantics are different. This CL repurposes the existing
    ObjectStrength enum as a replacement for them.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173973002

Cr-Commit-Position: refs/heads/master@{#28952}

X87: Vector ICs: ClassLiterals need to allocate a vector slot for home objects.

port b27016b78a7dd58dc682eed51500ba603b3e46b0 (r28827).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1178533002

Cr-Commit-Position: refs/heads/master@{#28951}

X87: Vector ICs: debugger should save registers for vector store ics.

port bd32a9f711cb14c2b7c34512d43e78bd24960124 (r28825).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173963002

Cr-Commit-Position: refs/heads/master@{#28950}

X87: Refactor lexical home object binding.

port 345fa142a9fca4b468417350ac26f61101d626e8 (r28802).

    port of r28769 overwrite some of r28802 so we port them again.

original commit message:

    Before this we had 3 super related lexical bindings that got injected
    into method bodies: .home_object, .this_function,  and new.target.
    With this change we get rid of the .home_object one in favor of using
    .this_function[home_object_symbol] which allows some simplifications
    throughout the code base.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173933005

Cr-Commit-Position: refs/heads/master@{#28949}

X87: [date] Refactor the %_DateField intrinsic to be optimizable.

port e4782a9b468258344d512a5f7dadbf1584928849 (r28782)

original commit message:

    Previously the %_DateField intrinsic would also check the object and
    throw an exception if you happen to pass something that is not a valid
    JSDate, which (a) violates our policy for instrinsics and (b) is hard to
    optimize in TurboFan (even Crankshaft has a hard time, but there we will
    never inline the relevant builtins, so it doesn't show up). The throwing
    part is now a separate intrinsics %_ThrowIfNotADate that throws an
    exception in full codegen and deoptimizes in Crankshaft, which means the
    code for the current use cases is roughly the same (modulo some register
    renamings/gap moves).

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1174913002

Cr-Commit-Position: refs/heads/master@{#28948}

Fix GCMole issue

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178883003

Cr-Commit-Position: refs/heads/master@{#28947}

Use the LookupIterator for SetElement and friends

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1172683003

Cr-Commit-Position: refs/heads/master@{#28946}

[turbofan] Merge sar/shr into MulHigh on ARM64

Merge a following arithmetic or logical right shift into the existing shift
of ARM64's Int32MulHigh or Uint32MulHigh code.

BUG=

Review URL: https://codereview.chromium.org/1179503003

Cr-Commit-Position: refs/heads/master@{#28945}

Revert of [arm64][turbofan]: Handle any immediate shift. (patchset #1 id:1 of https://codereview.chromium.org/1179733004/)

Reason for revert:
Breaks InstructionSelectorTest.Word64ShrWithWord64AndWithImmediate on debug builds (but not optdebug builds). I'll investigate.

Original issue's description:
> [arm64][turbofan]: Handle any immediate shift.
>
> With this patch, we can generate simple immediate-shift instructions for
> immediates outside the range "0 <= imm < width". Several related
> instruction selectors have also been updated accordingly.
>
> Example of generated code:
>
>     ---- Before ---         ---- After ----
>     movz w0, #33            lsr w0, w1, #1
>     lsr  w0, w1, w0
>
> BUG=
>
> Committed: https://crrev.com/36d771bbfa4af5efcc1c1dcf5b234445cb7ee722
> Cr-Commit-Position: refs/heads/master@{#28943}

TBR=bmeurer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176393002

Cr-Commit-Position: refs/heads/master@{#28944}

[arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179733004

Cr-Commit-Position: refs/heads/master@{#28943}

[turbofan] Materialize all from non-writable roots from root array.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1175113005

Cr-Commit-Position: refs/heads/master@{#28942}

[test] Skip slow test.

NOTRY=true

Review URL: https://codereview.chromium.org/1179693005

Cr-Commit-Position: refs/heads/master@{#28941}

[turbofan] Structure AccessBuilder interface a bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1178103002

Cr-Commit-Position: refs/heads/master@{#28940}

Always print external time in --trace-gc to make it toolable.

BUG=

Review URL: https://codereview.chromium.org/1173243003

Cr-Commit-Position: refs/heads/master@{#28939}

Add extras test for calling into runtime.

The alternative of passing an object template at context creation is
unfeasible because we need a context to instantiate the template.
At the time we create the context from snapshot or bootstrap from
scratch, we would already need that template instance, leading to a
chicken-and-egg problem.

This is an alternative that is simpler and less intrusive.

R=domenic@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1182443002

Cr-Commit-Position: refs/heads/master@{#28938}

[turbofan] Disable failing test262 tests after 84f208949b2e.

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1178123002

Cr-Commit-Position: refs/heads/master@{#28937}

[test] Add random seed stress mode to test runner.

NOTRY=true

Review URL: https://codereview.chromium.org/1180473003

Cr-Commit-Position: refs/heads/master@{#28936}

[turbofan] Enable support for try-catch statements.

R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1177743002

Cr-Commit-Position: refs/heads/master@{#28935}

Revert of [heap] Unify the immortal immovable root detection mechanism. (patchset #3 id:40001 of https://codereview.chromium.org/1178853002/)

Reason for revert:
[Sheriff] tsan failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4240

Original issue's description:
> [heap] Unify the immortal immovable root detection mechanism.
>
> Uniformly use the Heap::GetRootListIndex() and
> Heap::RootIsImmortalImmovable() methods to detect immortal immovable
> roots in the optimizing compilers.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/84e83da99a72edc169367bf88588b1a2f10c2e08
> Cr-Commit-Position: refs/heads/master@{#28933}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178083003

Cr-Commit-Position: refs/heads/master@{#28934}

[heap] Unify the immortal immovable root detection mechanism.

Uniformly use the Heap::GetRootListIndex() and
Heap::RootIsImmortalImmovable() methods to detect immortal immovable
roots in the optimizing compilers.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1178853002

Cr-Commit-Position: refs/heads/master@{#28933}

Revert of Add CHECKs to verify that we never finalize stale copies of external strings (patchset #1 id:1 of https://codereview.chromium.org/1160253010/)

Reason for revert:
not needed anymore

Original issue's description:
> Add CHECKs to verify that we never finalize stale copies of external strings
>
> BUG=none
> R=ulan@chromium.org
> LOG=n
>
> Committed: https://crrev.com/ca2f8d811ca08783e38ce5dd42d38a6b6a7b876f
> Cr-Commit-Position: refs/heads/master@{#28811}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1178703008

Cr-Commit-Position: refs/heads/master@{#28932}

Revert of Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1181533006/)

Reason for revert:
[Sheriff] Changes/breaks layout tests. Please land upstream needsmanualrebaseline requests first or fix the tests.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/400
One test fails, one times out. See e.g. expectations changes:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/400/layout-test-results/inspector/sources/debugger-async/async-callstack-promises-diff.txt

On linux debug theses tests crash:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/346
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/346/layout-test-results/results.html

Original issue's description:
> Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
>
> Reason for revert:
> Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.
>
> Original issue's description:
> > Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
> >
> > Reason for revert:
> > Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
> >
> > Original issue's description:
> > > Promise assimilation fix.
> > >
> > > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > > should call |y.then|, but the current implementation calls PromiseChain.
> > > We can see the difference when we set a custom function to |y.then|.
> > >
> > > This CL fixes the spec violation, but as a result |then| is no longer
> > > a wrapper of |chain| and in some cases it does not work well with
> > > |accept| or |chain|. That is not a problem for ES6 promise users because
> > > ES6 promise doesn't have them.
> > >
> > > LOG=N
> > > BUG=477921
> > >
> > > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > > Cr-Commit-Position: refs/heads/master@{#28926}
> >
> > TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=477921
> >
> > Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> > Cr-Commit-Position: refs/heads/master@{#28927}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/6f214bdd8bcdc76d48bd85c3bd897f0e2427ff95
> Cr-Commit-Position: refs/heads/master@{#28928}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181603003

Cr-Commit-Position: refs/heads/master@{#28931}

Whitespace change to test infra change.

Cr-Commit-Position: refs/heads/master@{#28930}

Revert of Re-land: Enable external startup by default on Linux. (patchset #3 id:40001 of https://codereview.chromium.org/1041683002/)

Reason for revert:
Revert, due to problems with stale build artefacts uncovered by this.

Details: https://code.google.com/p/v8/issues/detail?id=4171

Original issue's description:
> Re-land: Enable external startup by default on Linux.
>
> crrev.com/1016603004 should have fixed the issues that broke this last time.
>
> Notes:
> - The current functionality is meant to stay. If you prefer the old way,
>   just set v8_use_external_startup_data=0.
> - You might notice this if you call d8 via PATH. Either explicitly tell d8
>   where your external snapshot/built-ins are, or change the build options
>   as above.
> - This follows Chromium practice, that mostly uses this feature these days.
> - Other platforms to follow later.
>
> BUG=
>
> Committed: https://crrev.com/bb9c774c164c3552b67b4f1b60809852a44f2ecd
> Cr-Commit-Position: refs/heads/master@{#28858}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1177883003

Cr-Commit-Position: refs/heads/master@{#28929}

Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)

Reason for revert:
Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.

Original issue's description:
> Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
>
> Reason for revert:
> Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
>
> Original issue's description:
> > Promise assimilation fix.
> >
> > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > should call |y.then|, but the current implementation calls PromiseChain.
> > We can see the difference when we set a custom function to |y.then|.
> >
> > This CL fixes the spec violation, but as a result |then| is no longer
> > a wrapper of |chain| and in some cases it does not work well with
> > |accept| or |chain|. That is not a problem for ES6 promise users because
> > ES6 promise doesn't have them.
> >
> > LOG=N
> > BUG=477921
> >
> > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > Cr-Commit-Position: refs/heads/master@{#28926}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> Cr-Commit-Position: refs/heads/master@{#28927}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181533006

Cr-Commit-Position: refs/heads/master@{#28928}

Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)

Reason for revert:
Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829

Original issue's description:
> Promise assimilation fix.
>
> Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> should call |y.then|, but the current implementation calls PromiseChain.
> We can see the difference when we set a custom function to |y.then|.
>
> This CL fixes the spec violation, but as a result |then| is no longer
> a wrapper of |chain| and in some cases it does not work well with
> |accept| or |chain|. That is not a problem for ES6 promise users because
> ES6 promise doesn't have them.
>
> LOG=N
> BUG=477921
>
> Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> Cr-Commit-Position: refs/heads/master@{#28926}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1176163004

Cr-Commit-Position: refs/heads/master@{#28927}

Promise assimilation fix.

Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
should call |y.then|, but the current implementation calls PromiseChain.
We can see the difference when we set a custom function to |y.then|.

This CL fixes the spec violation, but as a result |then| is no longer
a wrapper of |chain| and in some cases it does not work well with
|accept| or |chain|. That is not a problem for ES6 promise users because
ES6 promise doesn't have them.

LOG=N
BUG=477921

Review URL: https://codereview.chromium.org/1098663002

Cr-Commit-Position: refs/heads/master@{#28926}

Make sure we do not start incremental marking in idle notification when incremental marking is turned off via flags.

BUG=chromium:498315
LOG=n

Review URL: https://codereview.chromium.org/1177953002

Cr-Commit-Position: refs/heads/master@{#28925}

PPC64: Adjust simulator stack safety margin.

This fixes a failure in test/mjsunit/regress/regress-crbug-491062.js.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1174693002

Cr-Commit-Position: refs/heads/master@{#28924}

Make writing of frame translation platform independent.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1175963002

Cr-Commit-Position: refs/heads/master@{#28923}

[turbofan] Record the SharedFunctionInfo of ALL inlined functions.

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

Review URL: https://codereview.chromium.org/1175953002

Cr-Commit-Position: refs/heads/master@{#28922}

[stl] Fix ZonePriorityQueue wrapper.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1179763002

Cr-Commit-Position: refs/heads/master@{#28921}

Revert of [turbofan] Record the SharedFunctionInfo of ALL inlined functions. (patchset #2 id:20001 of https://codereview.chromium.org/1175953002/)

Reason for revert:
Breaks Windows debug.

Original issue's description:
> [turbofan] Record the SharedFunctionInfo of ALL inlined functions.
>
> Previously we only recorded the SharedFunctionInfo of inlined functions
> that had at least one (lazy) deopt point left at code generation time.
>
> R=mstarzinger@chromium.org
>
> Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178683004

Cr-Commit-Position: refs/heads/master@{#28920}

[turbofan] Record the SharedFunctionInfo of ALL inlined functions.

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1175953002.

Cr-Commit-Position: refs/heads/master@{#28919}

[turbofan] Make IfException projections consume effects.

This is needed in order to allow expansion of a throwing node into a
set of nodes that produce different effects for the successful and the
exceptional continuation.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1179543002

Cr-Commit-Position: refs/heads/master@{#28918}

Update V8 DEPS.

Rolling v8/third_party/icu to a05f412f70489b77da0ddeb8baa31c68e3eff2c6

Rolling v8/tools/clang to 69fd1b485a2b24c872bfa4759342076751c9d490

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1176273002

Cr-Commit-Position: refs/heads/master@{#28917}

[test] Skip all philip layout tests to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1169813010

Cr-Commit-Position: refs/heads/master@{#28916}

[test] Speculatively skip some layout tests to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1179573003

Cr-Commit-Position: refs/heads/master@{#28915}

[test] Speculatively skip layout test to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1180523002

Cr-Commit-Position: refs/heads/master@{#28914}

MIPS: Skip test-heap/TestSizeOfRegExpCode

After https://codereview.chromium.org/1180433003 the code-size exceeeds
the limit for MIPS. We have some optimizations in place for MIPS64 that
will be ported back to MIPS, and will investigate other code-size
improvements so we can re-enable this test.

BUG=

Review URL: https://codereview.chromium.org/1166353005

Cr-Commit-Position: refs/heads/master@{#28913}

Increase the chance of printing a useful error when bootstrapping fails

Two changes:
  - In ReportBootstrappingException, if all we have is a string, it seems
    better to print that than nothing.
  - In Factory::NewError, there's no use trying to call into the builtins if
    compilation of the builtins is causing the exception (this currently
    results in a cryptic segfault if we trigger, say, a ReferenceError when
    executing builtins script during bootstrapping).

Review URL: https://codereview.chromium.org/1158013003

Cr-Commit-Position: refs/heads/master@{#28912}

Make RawMachineAssemblerTest emitting CFG always have a dummy End block

Frame Elider requires a sane CFG which should have such dummy end block.

BUG=

Review URL: https://codereview.chromium.org/1166293004

Cr-Commit-Position: refs/heads/master@{#28911}

[test] Speculatively skip layout test to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1173033003

Cr-Commit-Position: refs/heads/master@{#28910}

PPC: [deoptimizer] Basic support inlining based on SharedFunctionInfo.

Port cf21da7e485ac80b3071e477e5399a00ee2b365f

Original commit message:
Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1174963004

Cr-Commit-Position: refs/heads/master@{#28909}

Support rest parameters in arrow functions

R=dslomov@chromium.org, rossberg@chromium.org
LOG=Y
BUG=v8:2700

Review URL: https://codereview.chromium.org/1178523002

Cr-Commit-Position: refs/heads/master@{#28908}

MIPS: Replace numeric_limits<>::lowest() in cctest-assembler*.cc

On Mac for the requested minimal version (10.5) only old stl (from gcc 4.2.1) can be used so unfortunately we can't use numeric_limits<>::lowest() which were added in 874c54e05e92e04590b1026b495108abfd6063b7

BUG=
TEST=cctest/test-assembler-mips64, cctest/test-assembler-mips

Review URL: https://codereview.chromium.org/1175463003

Cr-Commit-Position: refs/heads/master@{#28907}

[deoptimizer] Basic support inlining based on SharedFunctionInfo.

Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1169103004

Cr-Commit-Position: refs/heads/master@{#28906}

Deserializer: flush code objects in large object space.

R=ulan@chromium.org,jacob.bramley@arm.com

Review URL: https://codereview.chromium.org/1173013002

Cr-Commit-Position: refs/heads/master@{#28905}

[test] Use generator to accelerate test runner startup.

This saves >1s for mjsunit and >10s for test262.

Review URL: https://codereview.chromium.org/1174923002

Cr-Commit-Position: refs/heads/master@{#28904}

Reland [test] Refactoring - Let runner handle test IDs.

Reason for revert:
All build problems had other reasons.

Original issue's description:
> Revert of [test] Refactoring - Let runner handle test IDs. (patchset #1 id:1 of https://codereview.chromium.org/1168303007/)
>
> Reason for revert:
> [Sheriff] Revert until the tree is in a better state.
>
> Original issue's description:
> > [test] Refactoring - Let runner handle test IDs.
> >
> > This prepares for properly rerunning tests. Currently when
> > tests are rerun, the same test object is reused. This
> > will be changed in a follow up.
> >
> > Committed: https://crrev.com/f41a81b8a513fc360c500c066b74f223bc9c0223
> > Cr-Commit-Position: refs/heads/master@{#28864}
>
> TBR=jkummerow@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/f83444a5f24381ec9ccc28b1e18e1e9370415bb2
> Cr-Commit-Position: refs/heads/master@{#28891}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1179483002

Cr-Commit-Position: refs/heads/master@{#28903}

Reland II of 'Optimize trivial regexp disjunctions' CL 1176453002

This change rewrites regexps like (ab|ac|z|ad|ae|af) into (a[b-f]|z).  We can only reorder disjunctions like this for case-dependent regexps.  For case-independent regexps, the disjunctions should be pre-sorted for best results.

R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1180433003

Cr-Commit-Position: refs/heads/master@{#28902}

Revert of Revert of [test] Refactoring - Use subject/observer pattern for progress indicators. (patchset #1 id:1 of https://codereview.chromium.org/1163373005/)

Reason for revert:
All build problems had other causes.

Original issue's description:
> Revert of [test] Refactoring - Use subject/observer pattern for progress indicators. (patchset #3 id:40001 of https://codereview.chromium.org/1171943002/)
>
> Reason for revert:
> might break stuff
>
> Original issue's description:
> > [test] Refactoring - Use subject/observer pattern for progress indicators.
> >
> > This should prevent bugs caused by missing super calls in
> > overridden methods. The assumption is that methods of
> > different indicators are independent.
> >
> > Committed: https://crrev.com/fbe973ff1722a6158a5b2babce9c1a32d26a1d3b
> > Cr-Commit-Position: refs/heads/master@{#28866}
>
> TBR=jkummerow@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/2a3962d9d2a7415378811f4d56522531332d5a3e
> Cr-Commit-Position: refs/heads/master@{#28869}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1176863002

Cr-Commit-Position: refs/heads/master@{#28901}

X87: [es6] Super call in arrows and eval

port 4b8051a02ae9f765b7d803fc7986301abde36007 (r28769)

original commit message:

    This splits the SuperReference AST node into SuperPropertyReference and
    SuperCallReference. The super call reference node consists of three
    unresolved vars to this, new.target and this_function. These gets
    declared when the right function is entered and if it is in use. The
    variables gets assigned in FullCodeGenerator::Generate.

    This is a revert of the revert 88b1c9170a0293cbcc8bdaf57fbe12744b48d7e8

BUG=

Review URL: https://codereview.chromium.org/1163983002

Cr-Commit-Position: refs/heads/master@{#28900}

[turbofan] Small cleanup in VisitTryCatchStatement.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1176513004

Cr-Commit-Position: refs/heads/master@{#28899}

X87: Build ObjectLiteral constant properties in the numbering phase.

port 450002f3a105d4bb17fd3b1a9d9d54464c01d200 (r28749)

original commit message:

    It's necessary to do this in order to know how many type feedback vector slots
    we should allocate for the object literal.

BUG=

Review URL: https://codereview.chromium.org/1168563003

Cr-Commit-Position: refs/heads/master@{#28898}

[turbofan] Deprecate NodeProperties::ReplaceWithValue.

This deprecates the aforementioned mutator in favor of a simpler
NodeProperties::ReplaceUses that doesn't perform any relaxation.
Preparation for enabling support for try-catch statements.

R=bmeurer@chromium.org
TEST=unittests/NodePropertiesTest

Review URL: https://codereview.chromium.org/1172773003

Cr-Commit-Position: refs/heads/master@{#28897}

Fix copy-pasteo in expression-classifier.h

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1174543003

Cr-Commit-Position: refs/heads/master@{#28896}

[test] Fix test archive clobber.

The old version would always clobber.

NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177503005

Cr-Commit-Position: refs/heads/master@{#28895}

[test] Clobber unclean test262-es6 checkouts.

Review URL: https://codereview.chromium.org/1173753004

Cr-Commit-Position: refs/heads/master@{#28894}

Bring back high promotion mode to shrink young generation size when scavenging latency is high.

BUG=

Review URL: https://codereview.chromium.org/1175663002

Cr-Commit-Position: refs/heads/master@{#28893}

Fix cluster-fuzz bug introduced in refs/heads/master@{#28796}.

Don't DCHECK when neutering that the buffer is not a SharedArrayBuffer;
instead, just return early.

BUG=chromium:498142,chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1174753002

Cr-Commit-Position: refs/heads/master@{#28892}

Revert of [test] Refactoring - Let runner handle test IDs. (patchset #1 id:1 of https://codereview.chromium.org/1168303007/)

Reason for revert:
[Sheriff] Revert until the tree is in a better state.

Original issue's description:
> [test] Refactoring - Let runner handle test IDs.
>
> This prepares for properly rerunning tests. Currently when
> tests are rerun, the same test object is reused. This
> will be changed in a follow up.
>
> Committed: https://crrev.com/f41a81b8a513fc360c500c066b74f223bc9c0223
> Cr-Commit-Position: refs/heads/master@{#28864}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1167343003

Cr-Commit-Position: refs/heads/master@{#28891}

Revert of Update Test262 to 5/30 (patchset #4 id:60001 of https://codereview.chromium.org/1136553008/)

Reason for revert:
[Sheriff] Still lots of breakages on some builders. E.g. http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/3313

Original issue's description:
> Update Test262 to 5/30
>
> This updates the test runner to run all tests in both sloppy
> and strict mode.
>
> It also marks the test in the status file as failing in
> sloppy mode even if all it does is marking the test as
> [PASS, FAIL]. A future CL will have to validate that the
> tests pass and fail in the correct mode.
>
> Committed: https://crrev.com/d869f4a4801d4ef6868c266c07f9e29d2e29cba5
> Cr-Commit-Position: refs/heads/master@{#28879}

TBR=rossberg@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1173933002

Cr-Commit-Position: refs/heads/master@{#28890}

Revert of [test262-es6] Temporary disable some tests (patchset #1 id:1 of https://codereview.chromium.org/1176573002/)

Reason for revert:
[Sheriff] Prepares revert of https://codereview.chromium.org/1136553008

Original issue's description:
> [test262-es6] Temporary disable some tests
>
> These tests have issues with our harness.
>
> Upstream fix: https://github.com/tc39/test262/pull/309
>
> BUG=N
> LOG=N
> TBR=machenbach@chromium.org
>
> Committed: https://crrev.com/eed7363a0da0f21c3eee6c052507299d9b707462
> Cr-Commit-Position: refs/heads/master@{#28881}

TBR=arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1169903006

Cr-Commit-Position: refs/heads/master@{#28889}

[turbofan] Fix context chain extension for top-level code.

For top-level code the closure passed into context allocation methods
needs to be replaced with a sentinel to canonicalize is to the empty
function object.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4169
BUG=v8:4169
LOG=N

Review URL: https://codereview.chromium.org/1172013002

Cr-Commit-Position: refs/heads/master@{#28888}

[frames] No GC is allowed while using the unhandlified TranslatedState.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1174593003.

Cr-Commit-Position: refs/heads/master@{#28887}

Update V8 DEPS.

Rolling v8/third_party/icu to 45a095d561334871dd8673cf8e5cca330d33f521

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1178433002

Cr-Commit-Position: refs/heads/master@{#28886}

Revert of Reland of 'Optimize trivial regexp disjunctions' CL 1176453002 (patchset #2 id:20001 of https://codereview.chromium.org/1174713002/)

Reason for revert:
Tree looks like a Christmas tree and this isn't helping

Original issue's description:
> Reland of 'Optimize trivial regexp disjunctions' CL 1176453002
>
> Original code review: https://codereview.chromium.org/1176453002/
>
> TBR=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/85fab0fa092e8d979413f6a61baec3abe26e568d
> Cr-Commit-Position: refs/heads/master@{#28884}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1172893002

Cr-Commit-Position: refs/heads/master@{#28885}

Reland of 'Optimize trivial regexp disjunctions' CL 1176453002

Original code review: https://codereview.chromium.org/1176453002/

TBR=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1174713002

Cr-Commit-Position: refs/heads/master@{#28884}

Moar clobbering landmines

Bots have been really lazy today and they have not picked up the
latest versions for some obscure reason

BUG=N
LOG=M
TBR=machenbach@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1171223002

Cr-Commit-Position: refs/heads/master@{#28883}

Implement %TypedArray%.prototype.slice

The initial implementation of this method takes a couple shortcuts:
- At some points in the spec, we should be making a reference to
  "Table 49" and instead do property lookup on the constructor.
  This is an issue with some other TypedArray methods too.
- The spec indicates that, if constructor and @@species haven't been
  messed with in particular ways, then there should be a memcpy
  from the old to the new. That fast path is not implemented here
  in this patch, but because V8 doesn't canonicalize NaN, the result
  isn't observably different.

BUG=v8:3578
LOG=Y
R=arv

Review URL: https://codereview.chromium.org/1170023002

Cr-Commit-Position: refs/heads/master@{#28882}

[test262-es6] Temporary disable some tests

These tests have issues with our harness.

Upstream fix: https://github.com/tc39/test262/pull/309

BUG=N
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1176573002

Cr-Commit-Position: refs/heads/master@{#28881}

Make old generation allocation throughput stats independent from the new space allocation throughput.

BUG=

Review URL: https://codereview.chromium.org/1167563005

Cr-Commit-Position: refs/heads/master@{#28880}

Update Test262 to 5/30

This updates the test runner to run all tests in both sloppy
and strict mode.

It also marks the test in the status file as failing in
sloppy mode even if all it does is marking the test as
[PASS, FAIL]. A future CL will have to validate that the
tests pass and fail in the correct mode.

Review URL: https://codereview.chromium.org/1136553008

Cr-Commit-Position: refs/heads/master@{#28879}

Revert of Optimize trivial regexp disjunctions (patchset #10 id:180001 of https://codereview.chromium.org/1176453002/)

Reason for revert:
ASAN failure

Original issue's description:
> Optimize trivial regexp disjunctions
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/5f1f7c15b3207f6c51d187692690aeb09d3e36b5
> Cr-Commit-Position: refs/heads/master@{#28871}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1174603002

Cr-Commit-Position: refs/heads/master@{#28878}

[turbofan] Fix one mean typo in kResolvePossiblyDirectEval.

R=titzer@chromium.org
TEST=mjsunit/regress/regress-eval-context

Review URL: https://codereview.chromium.org/1169853006

Cr-Commit-Position: refs/heads/master@{#28877}

[destructuring] Refactor duplicate parameter name detection.

Pushed the detection logic down to ParseAndClassifyIdentifier in
preparation to having patterns in parameter positions.

R=arv@chromium.org,rossberg@chromium.org,wingo@igalia.com
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1170153003

Cr-Commit-Position: refs/heads/master@{#28876}

Add landmine after change to messages.h

BUG=N
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1174523004

Cr-Commit-Position: refs/heads/master@{#28875}

Turbofan: Make type feedback vector a Node.

This improves code generation. Before, it was a constant loaded in a register
every time.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1175503002

Cr-Commit-Position: refs/heads/master@{#28874}

Fix issues with Arm's use of embedded constant pools

- Introduce Assembler::DataAlign for table alignment in code object
- Fix several misuses of r8 (alias of the pool pointer register, pp)
- Fix calculation of pp in OSR/handler entry invocation
- Enable missing cases in deserializer
- Fix references to ool constant pools in comments.

R=rmcilroy@chromium.org, michael_dawson@ca.ibm.com
BUG=chromium:497180
LOG=N

Review URL: https://codereview.chromium.org/1155673005

Cr-Commit-Position: refs/heads/master@{#28873}

Speed up ExpressionClassifier::Accumulate

The following changeset introduced a regression on CodeLoad of about 3%:

  https://chromium.googlesource.com/v8/v8/+/e73594c7fb3e6b5834b7ddfe78727fb994bab25f

This CL should reduce the regression to 1.5%.

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1163323006

Cr-Commit-Position: refs/heads/master@{#28872}

Optimize trivial regexp disjunctions

R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1176453002

Cr-Commit-Position: refs/heads/master@{#28871}

Revert of Revert of [es6] Parsing of new.target (patchset #1 id:1 of https://codereview.chromium.org/1170263002/)

Reason for revert:
The bot needs to be clobbered.

Original issue's description:
> Revert of [es6] Parsing of new.target (patchset #2 id:20001 of https://codereview.chromium.org/1169853002/)
>
> Reason for revert:
> [Sheriff] fails messages:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/1703
>
> Original issue's description:
> > [es6] Parsing of new.target
> >
> > BUG=v8:3887
> > LOG=N
> > R=adamk@chromium.org, dslomov@chromium.org
> >
> > Committed: https://crrev.com/ae06bdde7763d673b39948b710df414217265cce
> > Cr-Commit-Position: refs/heads/master@{#28865}
>
> TBR=adamk@chromium.org,dslomov@chromium.org,arv@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3887
>
> Committed: https://crrev.com/fe97cfccf3faabbeff87b9b5fbacd7ceb8219304
> Cr-Commit-Position: refs/heads/master@{#28868}

TBR=adamk@chromium.org,dslomov@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3887

Review URL: https://codereview.chromium.org/1168393008

Cr-Commit-Position: refs/heads/master@{#28870}

Revert of [test] Refactoring - Use subject/observer pattern for progress indicators. (patchset #3 id:40001 of https://codereview.chromium.org/1171943002/)

Reason for revert:
might break stuff

Original issue's description:
> [test] Refactoring - Use subject/observer pattern for progress indicators.
>
> This should prevent bugs caused by missing super calls in
> overridden methods. The assumption is that methods of
> different indicators are independent.
>
> Committed: https://crrev.com/fbe973ff1722a6158a5b2babce9c1a32d26a1d3b
> Cr-Commit-Position: refs/heads/master@{#28866}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1163373005

Cr-Commit-Position: refs/heads/master@{#28869}

Revert of [es6] Parsing of new.target (patchset #2 id:20001 of https://codereview.chromium.org/1169853002/)

Reason for revert:
[Sheriff] fails messages:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/1703

Original issue's description:
> [es6] Parsing of new.target
>
> BUG=v8:3887
> LOG=N
> R=adamk@chromium.org, dslomov@chromium.org
>
> Committed: https://crrev.com/ae06bdde7763d673b39948b710df414217265cce
> Cr-Commit-Position: refs/heads/master@{#28865}

TBR=adamk@chromium.org,dslomov@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3887

Review URL: https://codereview.chromium.org/1170263002

Cr-Commit-Position: refs/heads/master@{#28868}

MIPS64: Improve long branches utilizing code range.

Improves code size of generated regexp in TestSizeOfRegExpCode test by 33%.

Execution time of the same test improved by ~10%.

Utilizing code range for mips64 enable us to use J/JAL
instructions for long branches.

TEST=cctest/test-heap/TestSizeOfRegExpCode
BUG=

Review URL: https://codereview.chromium.org/1147503002

Cr-Commit-Position: refs/heads/master@{#28867}

[test] Refactoring - Use subject/observer pattern for progress indicators.

This should prevent bugs caused by missing super calls in
overridden methods. The assumption is that methods of
different indicators are independent.

Review URL: https://codereview.chromium.org/1171943002

Cr-Commit-Position: refs/heads/master@{#28866}

[es6] Parsing of new.target

BUG=v8:3887
LOG=N
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1169853002

Cr-Commit-Position: refs/heads/master@{#28865}

[test] Refactoring - Let runner handle test IDs.

This prepares for properly rerunning tests. Currently when
tests are rerun, the same test object is reused. This
will be changed in a follow up.

Review URL: https://codereview.chromium.org/1168303007

Cr-Commit-Position: refs/heads/master@{#28864}

Stage ES6 arrow functions

R=rossberg@chromium.org
BUG=v8:2700
LOG=Y

Review URL: https://codereview.chromium.org/1166303004

Cr-Commit-Position: refs/heads/master@{#28863}

[deoptimizer] Remove uses of TranslationIterator outside the deoptimizer.

Use the new TranslatedState and friends, which work at a higher level
than the TranslationIterator, which will make it easier to change the
deoptimization commands in subsequent CLs.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1166353004

Cr-Commit-Position: refs/heads/master@{#28862}

MIPS64: Fix bogus assert in AddI.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1170173002

Cr-Commit-Position: refs/heads/master@{#28861}

[frames] Remove obsolete JavaScriptFrame::GetInlineCount() method.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1176473002

Cr-Commit-Position: refs/heads/master@{#28860}

[turbofan] Make Runtime::kSetProperty have a frame state.

R=jarin@chromium.org
TEST=cctest/test-api/AccessCheckThrows

Review URL: https://codereview.chromium.org/1171943003

Cr-Commit-Position: refs/heads/master@{#28859}