Keep AllocationSpace and ObjectSpace enums in sync.

BUG=

Review URL: https://codereview.chromium.org/806693011

Cr-Commit-Position: refs/heads/master@{#25917}

[turbofan] Correctify lowering of Uint8ClampedArray buffer access.

TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}

[turbofan] Improve typing of ToBoolean.

According to ES6 draft, revision 29 (2014-12-06), section 7.1.2,
ToBoolean yields true for true, detectable receivers (the ES6 Object
type), symbols and numbers except -0, +0 and NaN.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/807663006

Cr-Commit-Position: refs/heads/master@{#25915}

X87: fix one test case failure under debug mode.

  This issue is exposed by CL https://codereview.chromium.org/807273003.

  The DeoptimizeIf(...) function will generate more Assembler code and the
  distance between the link point and the bind point is larger then near
  link distance (127) for labels.

BUG=

Review URL: https://codereview.chromium.org/820963002

Cr-Commit-Position: refs/heads/master@{#25914}

Make perf test runner more robust.

Convert all results to floats and log errors on failing
conversions. Otherwise these results bubble up into
buildbot.

TBR=tandrii@chromium.org
BUG=chromium:374740
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/811483008

Cr-Commit-Position: refs/heads/master@{#25913}

Revert of Remove obsolete V8_INFINITY macro. (patchset #3 id:40001 of https://codereview.chromium.org/798413003/)

Reason for revert:
Speculative revert. This seems to block the current roll: https://codereview.chromium.org/819653003/

I retried several times, also with a new roll. The error is internal - but that doesn't make much of a difference.

Original issue's description:
> Remove obsolete V8_INFINITY macro.
>
> Use std::numeric_limits consistently.
>
> R=svenpanne@chromium.org
>
> Committed: https://crrev.com/31c66e2d53569c4e229d55483d28208491e73612
> Cr-Commit-Position: refs/heads/master@{#25897}

TBR=svenpanne@chromium.org,bmeurer@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/813813003

Cr-Commit-Position: refs/heads/master@{#25912}

Revert of [mips] Fix typos introduced by previous commit. (patchset #1 id:1 of https://codereview.chromium.org/814203002/)

Reason for revert:
Needed in order to revert https://codereview.chromium.org/798413003

Original issue's description:
> [mips] Fix typos introduced by previous commit.
>
> R=svenpanne@chromium.org
>
> Committed: https://crrev.com/0c96a8b19730e79bc9cae08f3d86755c7b7c962e
> Cr-Commit-Position: refs/heads/master@{#25899}

TBR=svenpanne@chromium.org,bmeurer@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/822523002

Cr-Commit-Position: refs/heads/master@{#25911}

Support multiple interrupt requests in v8 API.

There might be a number of clients that would like to
setup an interrupt request on the Isolate.

The patch also deprecates ClearInterrupt API. As long as
the interrupt handler is called outside of locks there's no way
to guarantee that the handler will not be called after
ClearInterrupt was invoked as it might have already started execution.

Review URL: https://codereview.chromium.org/796623003

Cr-Commit-Position: refs/heads/master@{#25910}

Update V8 DEPS.

Rolling v8/buildtools to 23a4e2f545c7b6340d7e5a2b74801941b0a86535

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/812553008

Cr-Commit-Position: refs/heads/master@{#25909}

Use SetOwnElement when creating splice records in array length setter

This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Review URL: https://codereview.chromium.org/820503005

Cr-Commit-Position: refs/heads/master@{#25908}

Vector-based ICs also need to hold maps weakly.

Regular ICs in MONOMORPHIC and POLYMORPHIC state now hold onto maps with
WeakCells. Vector-based ICs should do the same.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/815953002

Cr-Commit-Position: refs/heads/master@{#25907}

MIPS64: Use weak cell in LoadGlobal handler.

Port bc0d2e237b1b624bed26ba849529b40329ea72a2

BUG=v8:3629
LOG=N
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/814193004

Cr-Commit-Position: refs/heads/master@{#25906}

Use weak cell to embed map in CompareNil IC.

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/812353002

Cr-Commit-Position: refs/heads/master@{#25905}

[turbofan] false is also falsish.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/814833006

Cr-Commit-Position: refs/heads/master@{#25904}

Follow-on to hydrogen fix keyed loads with string keys for vector ics.

r25817 optimized hydrogen keyed loads with string keys.
(https://codereview.chromium.org/755513003).
This CL adapts that work for the vector-ic keyed load.

BUG=

Review URL: https://codereview.chromium.org/820673002

Cr-Commit-Position: refs/heads/master@{#25903}

Use weak cell in LoadGlobal handler.

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/816923004

Cr-Commit-Position: refs/heads/master@{#25902}

[turbofan] Fix unsafe out-of-bounds check for checked loads/stores.

BUG=chromium:443744
LOG=y
TEST=mjsunit/compiler/regress-443744
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/804993004

Cr-Commit-Position: refs/heads/master@{#25901}

Improved --trace-opt output a bit.

This ensures that we always have a kind of "brace" around the actual compilation
with --trace-opt. Previously this was coupled to --trace-hydrogen for
Crankshaft, and there was no output at the start of the compilation for
TurboFan.

Removed redundant "[completed...]" output: Whenever the compilation was
successful, we have already printed "[optimizing...took...]".

Output total TurboFanning time with --trace-opt, too (basically as graph
building time, this is rather arbitrary).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/819613002

Cr-Commit-Position: refs/heads/master@{#25900}

[mips] Fix typos introduced by previous commit.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/814203002

Cr-Commit-Position: refs/heads/master@{#25899}

Make FlushICache NOP for Nvidia Denver CPU's.

Denver supports a coherent cache mechanism. There is no need to clean
the D cache and invalidate I cache. MTS has to check the translation
anytime there is an I cache invalidate and this time can be saved by
making FlushICache a NOP.

The patch improves Octane by roughly 3-4% on Denver.

Review URL: https://codereview.chromium.org/797233002

Cr-Commit-Position: refs/heads/master@{#25898}

Remove obsolete V8_INFINITY macro.

Use std::numeric_limits consistently.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/798413003

Cr-Commit-Position: refs/heads/master@{#25897}

[turbofan] Improve JSToBoolean typing.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/792013006

Cr-Commit-Position: refs/heads/master@{#25896}

Simplify scanner and generate better error message for legacy octals in templates

LOG=N
BUG=
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/812163003

Cr-Commit-Position: refs/heads/master@{#25895}

Update V8 DEPS.

Rolling v8/third_party/icu to 51c1a4ce5f362676aa1f1cfdb5b7e52edabfa5aa

TBR=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/816763003

Cr-Commit-Position: refs/heads/master@{#25894}

Define SDKROOT for Mac

otherwise, the clang we ship doesn't work

BUG=none
R=adamk@chromium.org,thakis@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/792783006

Cr-Commit-Position: refs/heads/master@{#25893}

Ship ES6 template literals

BUG=v8:3230
LOG=Y
R=dslomov@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/808413004

Cr-Commit-Position: refs/heads/master@{#25892}

ES6 template literals should not use legacy octal strings

Correctly handle SyntaxErrors in escape sequences.

BUG=v8:3736
LOG=Y
R=dslomov@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/811113002

Cr-Commit-Position: refs/heads/master@{#25891}

Reland Shrink initial old generation size based on new space survival rate.

I picked a more conservative start value this time of half max old generation size.

BUG=

Review URL: https://codereview.chromium.org/804323004

Cr-Commit-Position: refs/heads/master@{#25890}

Phantom references support internal fields

BUG=

Review URL: https://codereview.chromium.org/753553002

Cr-Commit-Position: refs/heads/master@{#25889}

Revert of [turbofan] simplify gap ordering (patchset #2 id:20001 of https://codereview.chromium.org/810013002/)

Reason for revert:
Revert for breaking emscripten bullet with turbofan on android arm64.

Original issue's description:
> [turbofan] simplify gap ordering
>
> BUG=
>
> Committed: https://crrev.com/70b5eb47b39acbf31746f4a116a9b3ce2730218a
> Cr-Commit-Position: refs/heads/master@{#25865}

TBR=bmeurer@chromium.org,dcarney@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/815743002

Cr-Commit-Position: refs/heads/master@{#25888}

Retain maps for several garbage collections

This keeps dying maps alive for FLAG_retain_maps_for_n_gc garbage collections to increase chances of them being reused for new objects in future.

BUG=v8:3664
LOG=N
TEST=cctest/test-heap/MapRetaining

Review URL: https://codereview.chromium.org/794583003

Cr-Commit-Position: refs/heads/master@{#25887}

Revert of [turbofan] Skip printing of empty gap moves. (patchset #1 id:1 of https://codereview.chromium.org/812983002/)

Reason for revert:
Needed to revert https://chromium.googlesource.com/v8/v8/+/70b5eb47b39acbf31746f4a116a9b3ce2730218a

Original issue's description:
> [turbofan] Skip printing of empty gap moves.
>
> R=bmeurer@chromium.org
> BUG=

TBR=bmeurer@chromium.org,titzer@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/816703002

Cr-Commit-Position: refs/heads/master@{#25886}

Reduce impact of HParameter inputs on HPhi representation selection

This is a follow-up to r25153.

BUG=v8:3766
LOG=n

Review URL: https://codereview.chromium.org/807273003

Cr-Commit-Position: refs/heads/master@{#25885}

Revert of [turbofan] remove control field from instruction (patchset #1 id:1 of https://codereview.chromium.org/810023002/)

Reason for revert:
Needed to revert https://chromium.googlesource.com/v8/v8/+/70b5eb47b39acbf31746f4a116a9b3ce2730218a

Original issue's description:
> [turbofan] remove control field from instruction
>
> R=titzer@chromium.org
> BUG=
>
> Committed: https://crrev.com/7b9cb2eb3764d0c807c669e397fc3b84fbefb175
> Cr-Commit-Position: refs/heads/master@{#25866}

TBR=titzer@chromium.org,dcarney@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/814043002

Cr-Commit-Position: refs/heads/master@{#25884}

Temporarily disable mjsunit/debug-stepframe for GC stress until
crash is fixed.

BUG=v8:3776
LOG=N
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/812283004

Cr-Commit-Position: refs/heads/master@{#25883}

Monomorphic and polymorphic ICs with cleared maps should not go megamorphic.

BUG=v8:3663
TEST=cctest/test-heap/MonomorphicStaysMonomorphicAfterGC
LOG=N

Review URL: https://codereview.chromium.org/816653002

Cr-Commit-Position: refs/heads/master@{#25882}

Make sure backing store pointer in handles get cleared after use in factory.

BUG=442710
LOG=n

Review URL: https://codereview.chromium.org/813023002

Cr-Commit-Position: refs/heads/master@{#25881}

Fixed -fsanitize=float-cast-overflow problems.

BUG=v8:3773
LOG=y

Review URL: https://codereview.chromium.org/809293003

Cr-Commit-Position: refs/heads/master@{#25880}

Don't use AddSubstring for external natives

The input string is not necessarily zero terminated

BUG=chromium:443230
R=adamk@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/795383003

Cr-Commit-Position: refs/heads/master@{#25879}

[turbofan] Skip printing of empty gap moves.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/812983002

Cr-Commit-Position: refs/heads/master@{#25878}

Crash with an error message when ICU data files are missing

Before, we'd just crash.

BUG=v8:3348
R=svenpanne@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/807313003

Cr-Commit-Position: refs/heads/master@{#25877}

Add script to check for clusterfuzz issues.

BUG=443153
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/811073002

Cr-Commit-Position: refs/heads/master@{#25876}

[turbofan] Further reduction of Word32And with Int32Add.

- (y * (K << L) + x) & (-1 << L) => (x & (-1 << L)) + y * (K << L)
- (x + y * (K << L)) & (-1 << L) => (x & (-1 << L)) + y * (K << L)

TEST=unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/811293002

Cr-Commit-Position: refs/heads/master@{#25875}

[turbofan] Also run MachineOperatorReducer in SimplifiedLoweringPhase.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/809313002

Cr-Commit-Position: refs/heads/master@{#25874}

Mozilla test status: Assign bug number to quadratic assembler arm64 issue & misc regexp cleanup

R=marja@chromium.org
BUG=

Review URL: https://codereview.chromium.org/810053002

Cr-Commit-Position: refs/heads/master@{#25873}

Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/792233008/)

Reason for revert:
[sheriff] Still crashes on win32 (XP):
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1380

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f497db156eb1010e9b4be398951280cb.
>
> This changes to do an early bailout in
> HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
> loop.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org,arv@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/811593004

Cr-Commit-Position: refs/heads/master@{#25872}

Whitespace change to trigger bots.

Cr-Commit-Position: refs/heads/master@{#25871}

Whitespace change to trigger bots.

Cr-Commit-Position: refs/heads/master@{#25870}

Whitespace change to trigger bots.

Cr-Commit-Position: refs/heads/master@{#25869}

ES6 computed property names

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f497db156eb1010e9b4be398951280cb.

This changes to do an early bailout in
HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
loop.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/792233008

Cr-Commit-Position: refs/heads/master@{#25868}

[turbofan] move assembly order to InstructionBlock

R=titzer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/805263003

Cr-Commit-Position: refs/heads/master@{#25867}

[turbofan] remove control field from instruction

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/810023002

Cr-Commit-Position: refs/heads/master@{#25866}

[turbofan] simplify gap ordering

BUG=

Review URL: https://codereview.chromium.org/810013002

Cr-Commit-Position: refs/heads/master@{#25865}

[turbofan] use START and END gap positions for constraints

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/798363007

Cr-Commit-Position: refs/heads/master@{#25864}

[turbofan] Improve reduction of Word32And and Int32Add.

TEST=unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/816433002

Cr-Commit-Position: refs/heads/master@{#25863}

Revert of Shrink initial old generation size based on new space survival rate. (patchset #7 id:140001 of https://codereview.chromium.org/785593002/)

Reason for revert:
Performance regressions.

Original issue's description:
> Shrink initial old generation size based on new space  survival rate.
>
> BUG=
>
> Committed: https://crrev.com/37f9bb72b9c7ea4eccef6cb6533b3c42792fb5e6
> Cr-Commit-Position: refs/heads/master@{#25850}

TBR=jochen@chromium.org,ulan@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/813733002

Cr-Commit-Position: refs/heads/master@{#25862}

[turbofan] Recursively reduce new inputs of changed nodes.

The GraphReducer should recurse into new inputs after a node was
changed. Most of the reducers already assume this behavior, and it
mostly worked by accident in many cases.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/800073004

Cr-Commit-Position: refs/heads/master@{#25861}

Allocate memory for external snapshot paths in d8

R=marja@chromium.org
BUG=chromium:442804
LOG=n

Review URL: https://codereview.chromium.org/791713003

Cr-Commit-Position: refs/heads/master@{#25860}

Revert of [turbofan] Correctify TruncateFloat64ToInt32 reduction in MachineOperatorReducer. (patchset #1 id:1 of https://codereview.chromium.org/801263002/)

Reason for revert:
Can cause reduce cycles, needs more investigation

Original issue's description:
> [turbofan] Correctify TruncateFloat64ToInt32 reduction in MachineOperatorReducer.
>
> TEST=unittests
> R=svenpanne@chromium.org
>
> Committed: https://chromium.googlesource.com/v8/v8/+/6e7ceee4d02a81f167d47d8c6dc57a226b8d98d4

TBR=svenpanne@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/794473003

Cr-Commit-Position: refs/heads/master@{#25859}

Allow timeout on regexp test

R=marja@chromium.org
BUG=

Review URL: https://codereview.chromium.org/798713004

Cr-Commit-Position: refs/heads/master@{#25858}

[turbofan] Handle collisions properly in value numbering.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/795433003

Cr-Commit-Position: refs/heads/master@{#25857}

Update V8 DEPS.

Rolling v8/tools/clang to 90fb65e7a9a5c9d6d9613dfb0e78921c52ca9cfc

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/795843004

Cr-Commit-Position: refs/heads/master@{#25856}

Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable

LOG=N
BUG=v8:3764, v8:3765
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/799803003

Cr-Commit-Position: refs/heads/master@{#25855}

ES6: Update unscopables to match spec

The spec ended up using Get(unscopables, propertyName) and
comparing the result to undefined instead of using Has.

BUG=v8:3632
LOG=Y
R=adamk, dslomov@chromium.org

Review URL: https://codereview.chromium.org/807893002

Cr-Commit-Position: refs/heads/master@{#25854}

Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/807173002/)

Reason for revert:
Crashes Win32. It was not flake.

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f497db156eb1010e9b4be398951280cb with
> no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
> try again.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/807033003

Cr-Commit-Position: refs/heads/master@{#25853}

Speed up ARM64 debug assembler more

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/810473004

Cr-Commit-Position: refs/heads/master@{#25852}

ES6 computed property names

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f497db156eb1010e9b4be398951280cb with
no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
try again.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/807173002

Cr-Commit-Position: refs/heads/master@{#25851}

Shrink initial old generation size based on new space  survival rate.

BUG=

Review URL: https://codereview.chromium.org/785593002

Cr-Commit-Position: refs/heads/master@{#25850}

ARM: check immediate overflow in branch and mov_label_offset in release mode to catch crashes earlier.

BUG=chromium:440913
LOG=N

Review URL: https://codereview.chromium.org/810763002

Cr-Commit-Position: refs/heads/master@{#25849}

Fix quadratic test in debug-mode ARM64 assembler

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/812593002

Cr-Commit-Position: refs/heads/master@{#25848}

Make sure FunctionToMethod is lazily compiled.

R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/808723002

Cr-Commit-Position: refs/heads/master@{#25847}

Bump the limit for test-heap/TestSizeOfRegExpCode

R=erik.corry@gmail.com

Review URL: https://codereview.chromium.org/808773003

Cr-Commit-Position: refs/heads/master@{#25846}

Add tools/find-commit-for-patch.py

It searches for a commit that a given patch can cleanly be applied to.

Review URL: https://codereview.chromium.org/799273003

Cr-Commit-Position: refs/heads/master@{#25845}

Follow-up to r25822: only internalize short strings optimistically

BUG=chromium:442703
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/809723002

Cr-Commit-Position: refs/heads/master@{#25844}

More -fsanitize=vptr fixes.

This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}

Introduced PropertyType ACCESSOR_FIELD.

Review URL: https://codereview.chromium.org/805453002

Cr-Commit-Position: refs/heads/master@{#25842}

[turbofan] enable stack slot reuse

BUG=

Review URL: https://codereview.chromium.org/793683002

Cr-Commit-Position: refs/heads/master@{#25841}

[turbofan] Cache conversions inserted during typed lowering.

This greatly reduces the number of nodes in the graph (by more than 20x in
some extreme cases) for the Emscripten python interpreter main function.

BUG=v8:3763
LOG=y
TEST=cctest,mjsunit,unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/802353003

Cr-Commit-Position: refs/heads/master@{#25840}

Limit code size generated for very large regexps

R=jkummerow@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/799403003

Cr-Commit-Position: refs/heads/master@{#25839}

RegExpParser: Fix Reset()ting to the end.

The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}

[turbofan] First version of loop analysis: loop finder on the soup of nodes.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/803993002

Cr-Commit-Position: refs/heads/master@{#25837}

[turbofan] Always align loop headers at 16-byte boundaries.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/811713002

Cr-Commit-Position: refs/heads/master@{#25836}

Log V8 version in profiler log file

Patch from issue 800293002 authored by ben@strongloop.com

TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/806143002

Cr-Commit-Position: refs/heads/master@{#25835}

[base] Add iterator_range helper class.

TEST=unittests
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/810683003

Cr-Commit-Position: refs/heads/master@{#25834}

X87: [turbofan] Remove the no-context hack for JSToNumber.

port d211608a3eb7ef3da4d04fd4f5a8540dedbd1faa

original commit message:
  [turbofan] Remove the no-context hack for JSToNumber.

  The ToNumberStub is now able to handle all plain primitives (Numbers,
  Booleans, Null, Undefined and Strings) without context access.

BUG=

Review URL: https://codereview.chromium.org/810683002

Cr-Commit-Position: refs/heads/master@{#25833}

[turbofan] Relax effects and context for JSToNumber(x:plain-primitive).

Relanded with fix for always returning Change for PlainPrimitive even
if there was no change. The performance regression on primes.js and
corrections.js is due to unlucky loop header alignment; will be addressed
separately.

TEST=unittests
R=svenpanne@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/75484e8d16866eba7aa9c3b87841cd6ce2f466b8

Review URL: https://codereview.chromium.org/799413002

Cr-Commit-Position: refs/heads/master@{#25832}

Revert of [turbofan] Relax effects and context for JSToNumber(x:plain-primitive). (patchset #1 id:1 of https://codereview.chromium.org/799413002/)

Reason for revert:
Performance regressions on primes and corrections benchmarks.

Original issue's description:
> [turbofan] Relax effects and context for JSToNumber(x:plain-primitive).
>
> TEST=unittests
> R=svenpanne@chromium.org
>
> Committed: https://chromium.googlesource.com/v8/v8/+/75484e8d16866eba7aa9c3b87841cd6ce2f466b8

TBR=svenpanne@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/806103002

Cr-Commit-Position: refs/heads/master@{#25831}

Update V8 DEPS.

Rolling v8/tools/clang to 6538d768c1dd43ad3942574cfc5ba90a8e1e0517

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/803183005

Cr-Commit-Position: refs/heads/master@{#25830}

Add infrastructure to keep track of references to prototypes.

There are no users of this infrastructure yet, so it's behind an off-by-default flag.

Review URL: https://codereview.chromium.org/768633002

Cr-Commit-Position: refs/heads/master@{#25829}

Use proper ToLength() operation in %ArrayConcat()

LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/799853003

Cr-Commit-Position: refs/heads/master@{#25828}

[GN] Output external snapshot blobs in out directory.

The snapshot and natives blob files should be output in the out directory
instead of the gen directory so that they can be picked up by the
executable.

BUG=421063
LOG=N

Review URL: https://codereview.chromium.org/805813004

Cr-Commit-Position: refs/heads/master@{#25827}

Ship ES6 classes.

R=arv@chromium.org
BUG=v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/808433002

Cr-Commit-Position: refs/heads/master@{#25826}

Revert of ES6 computed property names (patchset #9 id:160001 of https://codereview.chromium.org/795573005/)

Reason for revert:
Crashes on Win32

http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1357

Test: mjsunit/harmony/computed-property-names
Flags: --stress-opt --always-opt
Command: build\Release\d8.exe --test --random-seed=-233815021 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --harmony-computed-property-names test\mjsunit\mjsunit.js test\mjsunit\harmony\computed-property-names.js

Run #1
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #2
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #3
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> BUG=v8:3754
> LOG=Y

TBR=dslomov@chromium.org,wingo@igalia.com
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/809433002

Cr-Commit-Position: refs/heads/master@{#25825}

MIPS: [turbofan] Remove the no-context hack for JSToNumber.

Port d211608a3eb7ef3da4d04fd4f5a8540dedbd1faa

Original commit message:
The ToNumberStub is now able to handle all plain primitives (Numbers,
Booleans, Null, Undefined and Strings) without context access.

TEST=cctest,mjsunit,unittests
BUG=

Review URL: https://codereview.chromium.org/803973002

Cr-Commit-Position: refs/heads/master@{#25824}

Add fast path for array indices to Runtime_HasOwnProperty

Review URL: https://codereview.chromium.org/803833004

Cr-Commit-Position: refs/heads/master@{#25823}

Internalize strings being stored into uninitialized property cells

Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}

ES6 computed property names

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

BUG=v8:3754
LOG=Y

Review URL: https://codereview.chromium.org/795573005

Cr-Commit-Position: refs/heads/master@{#25821}

Take the build level into account for the version hash

build is the third number of the V8 version, and very likely to change
(in contrast to the patch level which typically is zero on canaries).

BUG=chromium:440984
R=mvstanton@chromium.org,yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/802363002

Cr-Commit-Position: refs/heads/master@{#25820}

Reland Call DisableInlineAllocation() in heap setup when flag inline_new is off.

BUG=

Review URL: https://codereview.chromium.org/806783002

Cr-Commit-Position: refs/heads/master@{#25819}

[turbofan] Relax effects and context for JSToNumber(x:plain-primitive).

TEST=unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/799413002

Cr-Commit-Position: refs/heads/master@{#25818}