Fix clobbered register when setting this_function variable.

R=arv@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1185703002

Cr-Commit-Position: refs/heads/master@{#29020}

Fix debug printing of inputs in the deoptimizer, pull out printing into separate methods.

Also fixed the duplicated output of context deopt.

BUG=

Review URL: https://codereview.chromium.org/1187533002

Cr-Commit-Position: refs/heads/master@{#29019}

[mjsunit] Remove unsupported flag --turbo-deoptimization from tests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}

[mjsunit] Remove obsolete nosse2 tests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1186713003

Cr-Commit-Position: refs/heads/master@{#29017}

Serializer: clear string hash for code serializer.

R=jochen@chromium.org
BUG=v8:4179
LOG=N

Review URL: https://codereview.chromium.org/1183483006

Cr-Commit-Position: refs/heads/master@{#29016}

Compute the heap growing factor based on mutator utilization and allocation throughput.

Doc: https://goo.gl/LLGvBs

BUG=

Review URL: https://codereview.chromium.org/1163143009

Cr-Commit-Position: refs/heads/master@{#29015}

Reland "Keep track of array buffers in new space separately"

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177293003

Cr-Commit-Position: refs/heads/master@{#29014}

Update V8 DEPS.

Rolling v8/third_party/android_tools to ed3dde6470c39b196c70f0c20374894d169754ec

Resubmission of https://codereview.chromium.org/1183753006/

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/1181413003

Cr-Commit-Position: refs/heads/master@{#29013}

Add test for code caching API.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180113002

Cr-Commit-Position: refs/heads/master@{#29012}

[turbofan] Mark MachineType as uint16_t.

This fixes a few funky implicit conversions for the enum (that are
inconsistent across compilers) and also helps to save space, i.e. for
the representations_ vector in the InstructionSequence.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1182303003

Cr-Commit-Position: refs/heads/master@{#29011}

[turbofan] Remove unused typedef VirtualRegisterSet.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1179913003

Cr-Commit-Position: refs/heads/master@{#29010}

Revert of Reland "Keep track of array buffers in new space separately" (patchset #2 id:20001 of https://codereview.chromium.org/1177083003/)

Reason for revert:
Still broken

Original issue's description:
> Reland "Keep track of array buffers in new space separately"
>
> Original review https://codereview.chromium.org/1133773002/
>
> BUG=v8:3996
> TBR=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/89b9a2cfb317e52186f682c91502b22932d52db3
> Cr-Commit-Position: refs/heads/master@{#28987}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1186613007

Cr-Commit-Position: refs/heads/master@{#29009}

Also handle elements in *RealNamed* api methods

Apparently the *RealNamed* API methods only have named variants, but were always used by the embedder to find elements as well. We'd never find them though, since we wouldn't even look
there.

This CL ensures we check whether the name is actually an array index.

I guess for all named API functions we should assume they are used similar to o["name"] where name could also be a number... At least we should make it uniform between embedder and V8. This matches us up with their expectations for now...

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177383004

Cr-Commit-Position: refs/heads/master@{#29008}

Update V8 DEPS.

Rolling v8/tools/clang to bb23ac0328fd3d051fc2f5ff027c8e0f87cc6fb5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1186753003

Cr-Commit-Position: refs/heads/master@{#29007}

Remove some unused definitions from d8.h

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184853003

Cr-Commit-Position: refs/heads/master@{#29006}

Currently on X87 platform we use only Double register (stack register) for Turbofan. So we directly
use 1 as allocatable Double register number when setting up the default register configuration..

It does not change the double register configuration of other platforms.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1164813007

Cr-Commit-Position: refs/heads/master@{#29005}

Introduce LookupIterator::PropertyOrElement which converts name to index if possible.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178893002

Cr-Commit-Position: refs/heads/master@{#29004}

X87: Disable the test case for X87 since ea2cb139d.

      The strong-object-set-proto test cases will throw one expected exception
      and the exception message should include the source position in the JS
      file. But crankshaft compiler does not generate the source position for
      it when creating the flow graph by default. The source position information
      is always zero. So it failed when comparing with the reference file.

      If we use crankshaft compiler on IA32 platform to run this test case, it
      has the same failure.

      we will open these test case for x87 once turbofan for X87 is enabled.

BUG=

Review URL: https://codereview.chromium.org/1179763003

Cr-Commit-Position: refs/heads/master@{#29003}

Introduce DefineOwnPropertyIgnoreAttributes and make it call SetPropertyWithInterceptor.

Otherwise using Object.defineProperty with window.localStorage will not actually store the value into the database but on the object itself.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180073002

Cr-Commit-Position: refs/heads/master@{#29002}

[test] More debugging output in test runner.

Also use again the taskkill method, recently removed in
https://codereview.chromium.org/1156133006/

BUG=chromium:485932
LOG=n
TBR=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177903005

Cr-Commit-Position: refs/heads/master@{#29001}

Reland of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180943002

Cr-Commit-Position: refs/heads/master@{#29000}

Map::TryUpdate() must be in sync with Map::Update().

This CL fixes elements kind transitions handling in Map::TryUpdate().

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1181163002

Cr-Commit-Position: refs/heads/master@{#28999}

Add script context with context-allocated "const this"

This is a reapplication of https://codereview.chromium.org/1173333004.

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1178903003

Cr-Commit-Position: refs/heads/master@{#28998}

[turbofan] Use appropriate type for NodeId.

Up until now we used int32_t for NodeId, but that was not ideal because
negative values are invalid for NodeId and we use it as an array index
for example in the NodeMarker class, where C++ compilers on x64 have to
generate code that does proper sign extension for the indices, which is
completely unnecessary.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1178403004

Cr-Commit-Position: refs/heads/master@{#28997}

Revert of Add script context with context-allocated "const this" (patchset #2 id:20001 of https://codereview.chromium.org/1173333004/)

Reason for revert:
nosnap failure

Original issue's description:
> Add script context with context-allocated "const this"
>
> This is a reapplication of https://codereview.chromium.org/1179893002/.
>
> R=rossberg@chromium.org,mstarzinger@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/cfc764f4050edc74aef92daa4c39ccc113893968
> Cr-Commit-Position: refs/heads/master@{#28994}

TBR=mstarzinger@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1177903004

Cr-Commit-Position: refs/heads/master@{#28996}

MIPS64: Fix memory allocation when code range is used for LO space only.

Allocation must respect requested reserve size, not requested commit area size.

Additionally fix check failures in debug mode for mips64.
After CL: https://codereview.chromium.org/1147503002/
memory for large code objects is allocated from code range,
memory for regular code objects is allocated normally.

TEST=cctest/test-spaces/MemoryChunk
BUG=

Review URL: https://codereview.chromium.org/1172333002

Cr-Commit-Position: refs/heads/master@{#28995}

Add script context with context-allocated "const this"

This is a reapplication of https://codereview.chromium.org/1179893002/.

R=rossberg@chromium.org,mstarzinger@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1173333004

Cr-Commit-Position: refs/heads/master@{#28994}

[turbofan] Move RawMachineAssembler to unittests.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177353003

Cr-Commit-Position: refs/heads/master@{#28993}

Revert of Add script context with context-allocated "const this" (patchset #7 id:120001 of https://codereview.chromium.org/1179893002/)

Reason for revert:
[Sheriff] Breaks gc mole:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/2435

Original issue's description:
> Add script context with context-allocated "const this"
>
> R=rossberg@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/fa32d461c16a053cc6d48d3fb326016bc2765765
> Cr-Commit-Position: refs/heads/master@{#28988}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1180043004

Cr-Commit-Position: refs/heads/master@{#28992}

Revert of MIPS64: Enable shorten-64-to-32 warning. (patchset #12 id:240001 of https://codereview.chromium.org/1133163005/)

Reason for revert:
Compile failure: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac64%20-%20debug/builds/3070/steps/compile/logs/stdio

Original issue's description:
> MIPS64: Enable shorten-64-to-32 warning.
>
> Port cdc43bc5fd02fff2905e2e28a79054d0d1eee3ea
>
> Original commit message:
> Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
> that arise.
>
> BUG=
>
> Committed: https://crrev.com/9af578a7c83b58a0ce25345998d9287cbf2030cb
> Cr-Commit-Position: refs/heads/master@{#28990}

TBR=danno@chromium.org,martyn.capewell@arm.com,paul.lind@imgtec.com,akos.palfi@imgtec.com,dusan.milosavljevic@imgtec.com,jkummerow@chromium.org,machenbach@chromium.org,svenpanne@chromium.org,balazs.kilvady@imgtec.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1182493007

Cr-Commit-Position: refs/heads/master@{#28991}

MIPS64: Enable shorten-64-to-32 warning.

Port cdc43bc5fd02fff2905e2e28a79054d0d1eee3ea

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1133163005

Cr-Commit-Position: refs/heads/master@{#28990}

External snapshot: allow empty snapshot for external snapshot.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180043003

Cr-Commit-Position: refs/heads/master@{#28989}

Add script context with context-allocated "const this"

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1179893002

Cr-Commit-Position: refs/heads/master@{#28988}

Reland "Keep track of array buffers in new space separately"

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177083003

Cr-Commit-Position: refs/heads/master@{#28987}

Whitespace change to test infra clean-ups.

Cr-Commit-Position: refs/heads/master@{#28986}

Update PrintStack signature in gdbinit

BUG=none
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1179053004

Cr-Commit-Position: refs/heads/master@{#28985}

Add support for walking stack frames from hydrogen stubs

R=yangguo@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184493003

Cr-Commit-Position: refs/heads/master@{#28984}

[turbofan] Inline hot functions for NodeMarkerBase.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1184693002.

Cr-Commit-Position: refs/heads/master@{#28983}

Whitespace change to test infra clean-ups.

Cr-Commit-Position: refs/heads/master@{#28982}

Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1182513002/)

Reason for revert:
[Sheriff] Speculative revert for changing layout tests:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/379/layout-test-results/results.html

Exact blame assignment is not possible as our blink bots were in a bad state for a few builds.

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> BUG=N
> LOG=N
> R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/4e2a673881c55a13124dd62f2d05c8d9fe233cd3
> Cr-Commit-Position: refs/heads/master@{#28968}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186463002

Cr-Commit-Position: refs/heads/master@{#28981}

[turbofan] Use RootIndexMap to speed up IsMaterializableFromRoot predicate.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181123002

Cr-Commit-Position: refs/heads/master@{#28980}

Revert of Keep track of array buffers in new space separately (patchset #4 id:60001 of https://codereview.chromium.org/1133773002/)

Reason for revert:
GC stress unhappy

Original issue's description:
> Keep track of array buffers in new space separately
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/506397d0a4241c19f5fab890e49e22d1d9b28bdc
> Cr-Commit-Position: refs/heads/master@{#28978}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1178403003

Cr-Commit-Position: refs/heads/master@{#28979}

Keep track of array buffers in new space separately

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1133773002

Cr-Commit-Position: refs/heads/master@{#28978}

Reland [arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179893003

Cr-Commit-Position: refs/heads/master@{#28977}

[turbofan] Prefer add/shift over madd on ARM64

Before selecting multiply-accumulate for a multiplication with add operation,
check that the multiply can't be reduced to add-with-shift. This prevents
simple multiplications by 3, 5, etc turning into register moves and madd
instructions.

Review URL: https://codereview.chromium.org/1180863002

Cr-Commit-Position: refs/heads/master@{#28976}

[turbofan] Fix throwing conversion inserted by JSTypedLowering.

This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}

Update V8 DEPS.

Rolling v8/tools/clang to 8b3ed2cb2e2512fa1074043cea3ada1143b80f26

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1179113002

Cr-Commit-Position: refs/heads/master@{#28974}

Use LookupIterator in GetOldValue

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178123003

Cr-Commit-Position: refs/heads/master@{#28973}

Add ToObject call in Array.prototype.sort

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}

[es6] Make sure we call add property when adding a new property

When setting a property using `super.prop = val` we need to use
add property if we are adding a new property and not set property.

BUG=493566
LOG=N
R=verwaest@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1161073002

Cr-Commit-Position: refs/heads/master@{#28971}

Remove ASSERT, this method can handle ExternalArrays just fine.

BUG=v8:4137
LOG=n
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1179983002.

Cr-Commit-Position: refs/heads/master@{#28970}

In Array.of and Array.from, fall back to DefineOwnProperty

%AddElement is not intended for objects which are not arrays, and
its behavior may go away with future refactorings. This patch gets
rid of it if the receiver of from or of is not the intrinsic Array
object.

Array.of and Array.from previously papered over failures in calling
[[DefineOwnProperty]] when setting array elements. This patch
makes them lead to exceptions, and adds tests to assert that
the appropriate exceptions are thrown.

BUG=v8:4168
R=adamk
CC=rossberg,verwaest
LOG=Y

Review URL: https://codereview.chromium.org/1181623003

Cr-Commit-Position: refs/heads/master@{#28969}

[es6] Bound function names

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

BUG=N
LOG=N
R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1182513002

Cr-Commit-Position: refs/heads/master@{#28968}

Reland of Use the LookupIterator in SetAccessor (patchset #1 id:1 of https://codereview.chromium.org/1175323004/)

Reason: Didn't break anything

Original issue's description:
> Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
>
> Reason for revert:
> Blocks reverting of https://codereview.chromium.org/1175973002
>
> Original issue's description:
> > Use the LookupIterator in SetAccessor
> >
> > BUG=v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> > Cr-Commit-Position: refs/heads/master@{#28955}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4137
>
> Committed: https://crrev.com/11dbd29de57b290ee8dac2a782a53f879beb416f
> Cr-Commit-Position: refs/heads/master@{#28956}

TBR=jkummerow@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181813002

Cr-Commit-Position: refs/heads/master@{#28967}

Revert of Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #1 id:1 of https://codereview.chromium.org/1179933002/)

Reason for revert:
Reland, this didn't break anything.

Original issue's description:
> Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)
>
> Reason for revert:
> It broke webkit_unit_tests
>
> Original issue's description:
> > Remove GetAttributes from the mix to avoid another virtual dispatch.
> >
> > BUG=chromium:495949,v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> > Cr-Commit-Position: refs/heads/master@{#28953}
>
> TBR=verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:495949,v8:4137
>
> Committed: https://crrev.com/ae639d2ad646237e2f413259a0f116845ef96440
> Cr-Commit-Position: refs/heads/master@{#28958}

TBR=ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1182603002

Cr-Commit-Position: refs/heads/master@{#28966}

Restore ExecutableAccessorInfoHandling for now

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1173283004.

Cr-Commit-Position: refs/heads/master@{#28965}

Decompiler improvements.

The main motivation is simplifying profiling activities:

1) Use hex instead of decimal for offsets, just like perf does. This
affects --print-opt-code

2) When printing block information, indicate loop information: if
block is header, where the end is; if block is in a loop, where the
loop starts. This affects --code-comments.

Using --print-opt-code --code-comments, and cross-referencing with data
obtained from perf, one may now find the block a hotspot belongs to
without needing to do hex2dec/dec2hex conversions. Once found, loop info
is available locally, on the block.

BUG=

Review URL: https://codereview.chromium.org/1177123002

Cr-Commit-Position: refs/heads/master@{#28964}

Use LookupIterator for elements in the observed part of DefineAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177103003

Cr-Commit-Position: refs/heads/master@{#28963}

Use LookupIterator for elements in GetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178083002

Cr-Commit-Position: refs/heads/master@{#28962}

Bound functions should also have configurable length

BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

PPC: smi test optimization

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1177263002

Cr-Commit-Position: refs/heads/master@{#28960}

Reconfigure on the right holder, which might be a hidden object.

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178953003.

Cr-Commit-Position: refs/heads/master@{#28959}

Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

Use the LookupIterator in SetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}

Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.

@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}

Remove GetAttributes from the mix to avoid another virtual dispatch.

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1175973002

Cr-Commit-Position: refs/heads/master@{#28953}

X87:  [strong] Refactor ObjectStrength into a replacement for strong boolean args

port dd8544495109804c632bfbcefc3c5c701e0a8c43 (r28839)

original commit message:

    Boolean "is_strong" parameters have begun to proliferate across areas where
    strong mode semantics are different. This CL repurposes the existing
    ObjectStrength enum as a replacement for them.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173973002

Cr-Commit-Position: refs/heads/master@{#28952}

X87: Vector ICs: ClassLiterals need to allocate a vector slot for home objects.

port b27016b78a7dd58dc682eed51500ba603b3e46b0 (r28827).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1178533002

Cr-Commit-Position: refs/heads/master@{#28951}

X87: Vector ICs: debugger should save registers for vector store ics.

port bd32a9f711cb14c2b7c34512d43e78bd24960124 (r28825).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173963002

Cr-Commit-Position: refs/heads/master@{#28950}

X87: Refactor lexical home object binding.

port 345fa142a9fca4b468417350ac26f61101d626e8 (r28802).

    port of r28769 overwrite some of r28802 so we port them again.

original commit message:

    Before this we had 3 super related lexical bindings that got injected
    into method bodies: .home_object, .this_function,  and new.target.
    With this change we get rid of the .home_object one in favor of using
    .this_function[home_object_symbol] which allows some simplifications
    throughout the code base.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173933005

Cr-Commit-Position: refs/heads/master@{#28949}

X87: [date] Refactor the %_DateField intrinsic to be optimizable.

port e4782a9b468258344d512a5f7dadbf1584928849 (r28782)

original commit message:

    Previously the %_DateField intrinsic would also check the object and
    throw an exception if you happen to pass something that is not a valid
    JSDate, which (a) violates our policy for instrinsics and (b) is hard to
    optimize in TurboFan (even Crankshaft has a hard time, but there we will
    never inline the relevant builtins, so it doesn't show up). The throwing
    part is now a separate intrinsics %_ThrowIfNotADate that throws an
    exception in full codegen and deoptimizes in Crankshaft, which means the
    code for the current use cases is roughly the same (modulo some register
    renamings/gap moves).

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1174913002

Cr-Commit-Position: refs/heads/master@{#28948}

Fix GCMole issue

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178883003

Cr-Commit-Position: refs/heads/master@{#28947}

Use the LookupIterator for SetElement and friends

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1172683003

Cr-Commit-Position: refs/heads/master@{#28946}

[turbofan] Merge sar/shr into MulHigh on ARM64

Merge a following arithmetic or logical right shift into the existing shift
of ARM64's Int32MulHigh or Uint32MulHigh code.

BUG=

Review URL: https://codereview.chromium.org/1179503003

Cr-Commit-Position: refs/heads/master@{#28945}

Revert of [arm64][turbofan]: Handle any immediate shift. (patchset #1 id:1 of https://codereview.chromium.org/1179733004/)

Reason for revert:
Breaks InstructionSelectorTest.Word64ShrWithWord64AndWithImmediate on debug builds (but not optdebug builds). I'll investigate.

Original issue's description:
> [arm64][turbofan]: Handle any immediate shift.
>
> With this patch, we can generate simple immediate-shift instructions for
> immediates outside the range "0 <= imm < width". Several related
> instruction selectors have also been updated accordingly.
>
> Example of generated code:
>
>     ---- Before ---         ---- After ----
>     movz w0, #33            lsr w0, w1, #1
>     lsr  w0, w1, w0
>
> BUG=
>
> Committed: https://crrev.com/36d771bbfa4af5efcc1c1dcf5b234445cb7ee722
> Cr-Commit-Position: refs/heads/master@{#28943}

TBR=bmeurer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176393002

Cr-Commit-Position: refs/heads/master@{#28944}

[arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179733004

Cr-Commit-Position: refs/heads/master@{#28943}

[turbofan] Materialize all from non-writable roots from root array.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1175113005

Cr-Commit-Position: refs/heads/master@{#28942}

[test] Skip slow test.

NOTRY=true

Review URL: https://codereview.chromium.org/1179693005

Cr-Commit-Position: refs/heads/master@{#28941}

[turbofan] Structure AccessBuilder interface a bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1178103002

Cr-Commit-Position: refs/heads/master@{#28940}

Always print external time in --trace-gc to make it toolable.

BUG=

Review URL: https://codereview.chromium.org/1173243003

Cr-Commit-Position: refs/heads/master@{#28939}

Add extras test for calling into runtime.

The alternative of passing an object template at context creation is
unfeasible because we need a context to instantiate the template.
At the time we create the context from snapshot or bootstrap from
scratch, we would already need that template instance, leading to a
chicken-and-egg problem.

This is an alternative that is simpler and less intrusive.

R=domenic@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1182443002

Cr-Commit-Position: refs/heads/master@{#28938}

[turbofan] Disable failing test262 tests after 84f208949b2e.

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1178123002

Cr-Commit-Position: refs/heads/master@{#28937}

[test] Add random seed stress mode to test runner.

NOTRY=true

Review URL: https://codereview.chromium.org/1180473003

Cr-Commit-Position: refs/heads/master@{#28936}

[turbofan] Enable support for try-catch statements.

R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1177743002

Cr-Commit-Position: refs/heads/master@{#28935}

Revert of [heap] Unify the immortal immovable root detection mechanism. (patchset #3 id:40001 of https://codereview.chromium.org/1178853002/)

Reason for revert:
[Sheriff] tsan failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4240

Original issue's description:
> [heap] Unify the immortal immovable root detection mechanism.
>
> Uniformly use the Heap::GetRootListIndex() and
> Heap::RootIsImmortalImmovable() methods to detect immortal immovable
> roots in the optimizing compilers.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/84e83da99a72edc169367bf88588b1a2f10c2e08
> Cr-Commit-Position: refs/heads/master@{#28933}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178083003

Cr-Commit-Position: refs/heads/master@{#28934}

[heap] Unify the immortal immovable root detection mechanism.

Uniformly use the Heap::GetRootListIndex() and
Heap::RootIsImmortalImmovable() methods to detect immortal immovable
roots in the optimizing compilers.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1178853002

Cr-Commit-Position: refs/heads/master@{#28933}

Revert of Add CHECKs to verify that we never finalize stale copies of external strings (patchset #1 id:1 of https://codereview.chromium.org/1160253010/)

Reason for revert:
not needed anymore

Original issue's description:
> Add CHECKs to verify that we never finalize stale copies of external strings
>
> BUG=none
> R=ulan@chromium.org
> LOG=n
>
> Committed: https://crrev.com/ca2f8d811ca08783e38ce5dd42d38a6b6a7b876f
> Cr-Commit-Position: refs/heads/master@{#28811}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1178703008

Cr-Commit-Position: refs/heads/master@{#28932}

Revert of Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1181533006/)

Reason for revert:
[Sheriff] Changes/breaks layout tests. Please land upstream needsmanualrebaseline requests first or fix the tests.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/400
One test fails, one times out. See e.g. expectations changes:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/400/layout-test-results/inspector/sources/debugger-async/async-callstack-promises-diff.txt

On linux debug theses tests crash:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/346
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/346/layout-test-results/results.html

Original issue's description:
> Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
>
> Reason for revert:
> Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.
>
> Original issue's description:
> > Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
> >
> > Reason for revert:
> > Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
> >
> > Original issue's description:
> > > Promise assimilation fix.
> > >
> > > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > > should call |y.then|, but the current implementation calls PromiseChain.
> > > We can see the difference when we set a custom function to |y.then|.
> > >
> > > This CL fixes the spec violation, but as a result |then| is no longer
> > > a wrapper of |chain| and in some cases it does not work well with
> > > |accept| or |chain|. That is not a problem for ES6 promise users because
> > > ES6 promise doesn't have them.
> > >
> > > LOG=N
> > > BUG=477921
> > >
> > > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > > Cr-Commit-Position: refs/heads/master@{#28926}
> >
> > TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=477921
> >
> > Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> > Cr-Commit-Position: refs/heads/master@{#28927}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/6f214bdd8bcdc76d48bd85c3bd897f0e2427ff95
> Cr-Commit-Position: refs/heads/master@{#28928}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181603003

Cr-Commit-Position: refs/heads/master@{#28931}

Whitespace change to test infra change.

Cr-Commit-Position: refs/heads/master@{#28930}

Revert of Re-land: Enable external startup by default on Linux. (patchset #3 id:40001 of https://codereview.chromium.org/1041683002/)

Reason for revert:
Revert, due to problems with stale build artefacts uncovered by this.

Details: https://code.google.com/p/v8/issues/detail?id=4171

Original issue's description:
> Re-land: Enable external startup by default on Linux.
>
> crrev.com/1016603004 should have fixed the issues that broke this last time.
>
> Notes:
> - The current functionality is meant to stay. If you prefer the old way,
>   just set v8_use_external_startup_data=0.
> - You might notice this if you call d8 via PATH. Either explicitly tell d8
>   where your external snapshot/built-ins are, or change the build options
>   as above.
> - This follows Chromium practice, that mostly uses this feature these days.
> - Other platforms to follow later.
>
> BUG=
>
> Committed: https://crrev.com/bb9c774c164c3552b67b4f1b60809852a44f2ecd
> Cr-Commit-Position: refs/heads/master@{#28858}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1177883003

Cr-Commit-Position: refs/heads/master@{#28929}

Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)

Reason for revert:
Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.

Original issue's description:
> Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
>
> Reason for revert:
> Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
>
> Original issue's description:
> > Promise assimilation fix.
> >
> > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > should call |y.then|, but the current implementation calls PromiseChain.
> > We can see the difference when we set a custom function to |y.then|.
> >
> > This CL fixes the spec violation, but as a result |then| is no longer
> > a wrapper of |chain| and in some cases it does not work well with
> > |accept| or |chain|. That is not a problem for ES6 promise users because
> > ES6 promise doesn't have them.
> >
> > LOG=N
> > BUG=477921
> >
> > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > Cr-Commit-Position: refs/heads/master@{#28926}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> Cr-Commit-Position: refs/heads/master@{#28927}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181533006

Cr-Commit-Position: refs/heads/master@{#28928}

Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)

Reason for revert:
Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829

Original issue's description:
> Promise assimilation fix.
>
> Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> should call |y.then|, but the current implementation calls PromiseChain.
> We can see the difference when we set a custom function to |y.then|.
>
> This CL fixes the spec violation, but as a result |then| is no longer
> a wrapper of |chain| and in some cases it does not work well with
> |accept| or |chain|. That is not a problem for ES6 promise users because
> ES6 promise doesn't have them.
>
> LOG=N
> BUG=477921
>
> Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> Cr-Commit-Position: refs/heads/master@{#28926}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1176163004

Cr-Commit-Position: refs/heads/master@{#28927}

Promise assimilation fix.

Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
should call |y.then|, but the current implementation calls PromiseChain.
We can see the difference when we set a custom function to |y.then|.

This CL fixes the spec violation, but as a result |then| is no longer
a wrapper of |chain| and in some cases it does not work well with
|accept| or |chain|. That is not a problem for ES6 promise users because
ES6 promise doesn't have them.

LOG=N
BUG=477921

Review URL: https://codereview.chromium.org/1098663002

Cr-Commit-Position: refs/heads/master@{#28926}

Make sure we do not start incremental marking in idle notification when incremental marking is turned off via flags.

BUG=chromium:498315
LOG=n

Review URL: https://codereview.chromium.org/1177953002

Cr-Commit-Position: refs/heads/master@{#28925}

PPC64: Adjust simulator stack safety margin.

This fixes a failure in test/mjsunit/regress/regress-crbug-491062.js.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1174693002

Cr-Commit-Position: refs/heads/master@{#28924}

Make writing of frame translation platform independent.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1175963002

Cr-Commit-Position: refs/heads/master@{#28923}

[turbofan] Record the SharedFunctionInfo of ALL inlined functions.

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

Review URL: https://codereview.chromium.org/1175953002

Cr-Commit-Position: refs/heads/master@{#28922}

[stl] Fix ZonePriorityQueue wrapper.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1179763002

Cr-Commit-Position: refs/heads/master@{#28921}