Serializer: assert that we deserialize only one native context.

R=mvstanton@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1097893002

Cr-Commit-Position: refs/heads/master@{#27932}

Fix serialization statistics for external strings.

External strings are serialized as internal strings. The current way
of collecting stats is slightly wrong. We ought to use the map and
size passed to SerializePrologue.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1092253003

Cr-Commit-Position: refs/heads/master@{#27931}

[mjsunit] Import test case based on the Massive/SQLite benchmark.

This adds a stripped down version of the SQLite benchmark (running with
--size 1) to the mjsunit suite. We might want to move that to a
dedicated slow/stress/whatever test suite once an appropriate decision
is made.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1094043002

Cr-Commit-Position: refs/heads/master@{#27930}

Clean up output of heap object tracing

BUG=

Review URL: https://codereview.chromium.org/1097683002

Cr-Commit-Position: refs/heads/master@{#27929}

Update V8 DEPS.

Rolling v8/tools/clang to d3e6123fdadc4bf98b8c676173f77f8f8eed363f

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1096893002

Cr-Commit-Position: refs/heads/master@{#27928}

[modules] Parsing: add ModuleRequests where missing

Two last forms supported in this patch:
  - 'import' ModuleSpecifier
  - 'export' '*' 'from' ModuleSpecifier.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/1094963002

Cr-Commit-Position: refs/heads/master@{#27927}

Adding missing V8_EXPORT flag in SpaceStatistics class in v8.h

This class was added in crrev.com/1058253003 and missed V8_EXPORT in
definition.

BUG=466141, 476013
LOG=Y

Review URL: https://codereview.chromium.org/1090333002

Cr-Commit-Position: refs/heads/master@{#27926}

Turn off SupportsFlexibleFloorAndRound for Arm64 due to a bug.

There is a bug with SupportsFlexibleFloorAndRound on Arm64. Turn it off for
now until we figure out a proper solution.

BUG=chromium:476477
LOG=Y

Review URL: https://codereview.chromium.org/1093863002

Cr-Commit-Position: refs/heads/master@{#27925}

Initialize idle old generation allocation limit in constructor.

BUG=478082
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/1093853002

Cr-Commit-Position: refs/heads/master@{#27924}

PPC: Reland "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"

Port 8098253562c7585405f435145e7acf74ff0123f8

R=verwaest@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1057413003

Cr-Commit-Position: refs/heads/master@{#27923}

[visualizer]: Add types to visualizer output

Review URL: https://codereview.chromium.org/1083083006

Cr-Commit-Position: refs/heads/master@{#27922}

Fix GC-induced DCHECK failure in Runtime_GetWeakMapEntries

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1091253002

Cr-Commit-Position: refs/heads/master@{#27921}

Wrap object observe implementation in a function.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1086813005

Cr-Commit-Position: refs/heads/master@{#27920}

Adding V8 api to get memory statistics of spaces in V8::Heap.

This is first step towards adding V8 heap statistics to the memory
tracing infrastructure. For being able to get useful memory number into
the memory dump, v8 needs to provide an external api needs to obtain
more information about the heap. So, this Cl extends the api to give
information about the memory allocated and used in the spaces.

BUG=466141, 476013
LOG=Y

Review URL: https://codereview.chromium.org/1058253003

Cr-Commit-Position: refs/heads/master@{#27919}

Wrap JSON and generator implementation in functions.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1097703002

Cr-Commit-Position: refs/heads/master@{#27918}

Migrate error messages, part 3 (runtime.js).

Motivation for this is reducing the size of the native context.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1089303003

Cr-Commit-Position: refs/heads/master@{#27917}

Don't use normalized map cache for prototype maps

BUG=chromium:477924
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1090193002

Cr-Commit-Position: refs/heads/master@{#27916}

Bump limit in PushStackTraceAndDie

To increase the chances of minidumps containing enough useful information

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1068783006

Cr-Commit-Position: refs/heads/master@{#27915}

Rename some things around incremental marking triggers

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1094843002

Cr-Commit-Position: refs/heads/master@{#27914}

Whitespace commit to trigger bots.

Cr-Commit-Position: refs/heads/master@{#27913}

Revert "Factor formal argument parsing into ParserBase"

Revert https://codereview.chromium.org/1078093002/ and follow-on parser
patches due to a perf regression.

This reverts commit 53ddccfc33f7052429e3261e15a2bbabb05760b3.
This reverts commit 71d3213a3f9da3f2ade37fe22ad02d8a658172c2.
This reverts commit 0f432ebb76350a69d59edc303c181c8ba1719c96.
This reverts commit 1dbc43272954e8cfdf7be9a57c953a74b2a4d9da.

R=marja@chromium.org

Review URL: https://codereview.chromium.org/1094653002

Cr-Commit-Position: refs/heads/master@{#27912}

[crankshaft] Fix property access with proxies in prototype chain

BUG=

Review URL: https://codereview.chromium.org/1090813003

Cr-Commit-Position: refs/heads/master@{#27911}

Disable always-opt for locker tests.

In no-snap mode, creating 100 contexts can take a while.
This becomes even worse with always-opt.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1092003002

Cr-Commit-Position: refs/heads/master@{#27910}

Fix DCHECK with unsigned int in zone.cc.

R=svenpanne@chromium.org
BUG=v8:4037
LOG=N

Review URL: https://codereview.chromium.org/1051213005

Cr-Commit-Position: refs/heads/master@{#27909}

Re-enable an UNREACHABLE in JSObject::GetHeaderSize()

Review URL: https://codereview.chromium.org/1091553002

Cr-Commit-Position: refs/heads/master@{#27908}

Reland "Migrate error messages, part 2."

Review URL: https://codereview.chromium.org/1083083004

Cr-Commit-Position: refs/heads/master@{#27907}

X87: Reland "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"

port 8098253562c7585405f435145e7acf74ff0123f8 (r27898)

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1086813004

Cr-Commit-Position: refs/heads/master@{#27906}

Let asan imply clang and use_allocator=none.

BUG=

Review URL: https://codereview.chromium.org/1089393004

Cr-Commit-Position: refs/heads/master@{#27905}

Revert of Refactor compilation dependency handling. (patchset #4 id:60001 of https://codereview.chromium.org/1095433002/)

Reason for revert:
[Sheriff] Causes crashes in laout tests:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2543

Extra bisect run:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2548

Original issue's description:
> Refactor compilation dependency handling.
>
> Extract a new data structure CompilationDependencies and move (most) logic there.
>
> R=mstarzinger@chromium.org,verwaest@chromium.org
> BUG=
>
> Committed: https://crrev.com/b882479f1c84a48961b8aec81fa1bb1225034784
> Cr-Commit-Position: refs/heads/master@{#27892}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1093783002

Cr-Commit-Position: refs/heads/master@{#27904}

Update V8 DEPS.

Rolling v8/tools/clang to 2afd19d64f7c67c73e2052e87fbe4e1bc2a671c9

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1098623002

Cr-Commit-Position: refs/heads/master@{#27903}

Revert of Revert "Remove early bail-out in VisitWeakList to investigate chrasher." (patchset #1 id:1 of https://codereview.chromium.org/1080303002/)

Reason for revert:
Still doesn't work

Original issue's description:
> Revert "Remove early bail-out in VisitWeakList to investigate chrasher."
>
> >  BUG=468601
> >  LOG=n
> >
> >  Review URL: https://codereview.chromium.org/1016353002
> >
> >  Cr-Commit-Position: refs/heads/master@{#27317}
>
> R=hpayer@chromium.org
> BUG=v8:3996,chromium:468601
> LOG=n
>
> Committed: https://crrev.com/835eeafe32f442d7b43fe175237de2c70ed7ceef
> Cr-Commit-Position: refs/heads/master@{#27814}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996,chromium:468601

Review URL: https://codereview.chromium.org/1092783002

Cr-Commit-Position: refs/heads/master@{#27902}

Serializer: share executable accessor infos between native contexts.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1081443006

Cr-Commit-Position: refs/heads/master@{#27901}

Properly report OOM when deoptimizer allocation fails

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1052823003

Cr-Commit-Position: refs/heads/master@{#27900}

Don't crash when reporting an access check failure for a detached global proxy

BUG=chromium:475884
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1086403002

Cr-Commit-Position: refs/heads/master@{#27899}

Reland "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"

BUG=chromium:476592
LOG=n

Review URL: https://codereview.chromium.org/1086333002

Cr-Commit-Position: refs/heads/master@{#27898}

Use smaller heap growing factor in idle notification to start incremental marking when there is idle time >16ms.

BUG=chromium:477323
LOG=y

Review URL: https://codereview.chromium.org/1090963002

Cr-Commit-Position: refs/heads/master@{#27897}

[turbofan] Add single --turbo flag.

This flag is intended as a staging flag for TurboFan. It serves as a
single flag that always enables a most recent configuration of TurboFan
for test suites and benchmarks, without needing to update test drivers.

R=titzer@chromium.org,machenbach@chromium.org

Review URL: https://codereview.chromium.org/1094573002

Cr-Commit-Position: refs/heads/master@{#27896}

PPC: Array() in optimized code can create with wrong ElementsKind in corner cases.

Port 13459c1ae3caa4cc546c522177bac5450a3252bf

Original commit message:
Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

R=mvstanton@chromium.org, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1089913002

Cr-Commit-Position: refs/heads/master@{#27895}

MIPS: Fix for StringCharCodeAtGenerator for vector-ics.

Register pop order bug only surfaced after vector-ic optimization
in https://codereview.chromium.org/1053843003 was landed.

TEST=mjsunit/string-index.js
BUG=

Review URL: https://codereview.chromium.org/1074123004

Cr-Commit-Position: refs/heads/master@{#27894}

Reland MIPS: Vector-ICs - speed towards the monomorphic exit as quickly as possible.

Port 35a67b745d862c5b1f584c2786ebf1369dc4f1ff

Original commit message:
Thanks to some careful assumptions, we can examine the object found at
vector[slot] and trust it's a heap object where the second field is
either a map if it's a WeakCell, or definitely not a map if it's a
Symbol, String or FixedArray. Use this to save a memory read.

BUG=

Review URL: https://codereview.chromium.org/1053843003

Cr-Commit-Position: refs/heads/master@{#27757}

Review URL: https://codereview.chromium.org/1083413003

Cr-Commit-Position: refs/heads/master@{#27893}

Refactor compilation dependency handling.

Extract a new data structure CompilationDependencies and move (most) logic there.

R=mstarzinger@chromium.org,verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095433002

Cr-Commit-Position: refs/heads/master@{#27892}

Move GetRootListIndex into Heap.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095513003

Cr-Commit-Position: refs/heads/master@{#27891}

Make test unthreaded so other tests don't interfere with heap size

R=hpayer@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1086423003

Cr-Commit-Position: refs/heads/master@{#27890}

Revert of Migrate error messages, part 2. (patchset #1 id:1 of https://codereview.chromium.org/1086313003/)

Reason for revert:
[Sheriff]: This changes layout test expectations e.g.
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Win/builds/2964

Original issue's description:
> Migrate error messages, part 2.
>
> Motivation for this is reducing the size of the native context.
>
> Committed: https://crrev.com/d3b788df0a4ccfedbe6e1df5e214cb6ba2792a65
> Cr-Commit-Position: refs/heads/master@{#27878}

TBR=mvstanton@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1095573002

Cr-Commit-Position: refs/heads/master@{#27889}

[strong] Allow mutually recursive classes.

The previous restrictions were overshooting (didn't allow a class to refer to a
later class under any circumstances); after this CL we're undershooting (allow
referring to any class from inside a method).

Implementing the correct checks (allow referring only if the class declarations
are in a consecutive block and if there's no dependency cycle) will be
implemented as a follow up.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1087543004

Cr-Commit-Position: refs/heads/master@{#27888}

Serializer: collect and output memory statistics.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1086363002

Cr-Commit-Position: refs/heads/master@{#27887}

Add a flag to trace heap object stats on GC.

BUG=

Review URL: https://codereview.chromium.org/1094613002

Cr-Commit-Position: refs/heads/master@{#27886}

[strong] Implement static restrictions on switch statement

Implements the strong mode proposal's restrictions on the syntax of the
switch statement. Also fixes a minor bug with empty statements in strong
mode and improves StrongUndefinedArrow parser synch tests.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1084983002

Cr-Commit-Position: refs/heads/master@{#27885}

If a code space commit partially succeeds, free the memory

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1086253004

Cr-Commit-Position: refs/heads/master@{#27884}

Fix logic for doing incremental marking steps on tenured allocation.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1040233003

Cr-Commit-Position: refs/heads/master@{#27883}

Store hashes of current and previous shipped V8 version

Will be used for calculating changes between versions

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1095483002

Cr-Commit-Position: refs/heads/master@{#27882}

Disable more failing tests after f3338dd3b01c.

TBR=jkummerow@chromium.org
TEST=mjsunit/debug-ignore-breakpoints
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1087673003

Cr-Commit-Position: refs/heads/master@{#27881}

Simplify DoParseProgram

DoParseProgram doesn't appear to need to receive toplevel scopes as
arguments; it can properly set the end_position of the scopes to the
scanner's position after parsing is complete.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1091743002

Cr-Commit-Position: refs/heads/master@{#27880}

Wrap map and set implementation in functions.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1094563002

Cr-Commit-Position: refs/heads/master@{#27879}

Migrate error messages, part 2.

Motivation for this is reducing the size of the native context.

Review URL: https://codereview.chromium.org/1086313003

Cr-Commit-Position: refs/heads/master@{#27878}

X87: Use Cells to check prototype chain validity (disabled by default).

port 0179ec57975c5063bbecd98e11cdda77ddad8996 (r27846).

original commit message:

 The cells are stored on prototypes (in their map's PrototypeInfo). When a
 prototype object changes its map, then both its own validity cell and those
 of all "downsstream" prototypes are invalidated; handlers for a given receiver
 embed the currently valid cell for that receiver's prototype during their
 compilation and check it on execution.

BUG=

Review URL: https://codereview.chromium.org/1090803002

Cr-Commit-Position: refs/heads/master@{#27877}

Make store buffer more robust to OOM.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1086263002

Cr-Commit-Position: refs/heads/master@{#27876}

X87: Array() in optimized code can create with wrong ElementsKind in corner cases

port 13459c1ae3caa4cc546c522177bac5450a3252bf (r27857)

original commit message:

    Array() in optimized code can create with wrong ElementsKind in corner cases.

    Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
    makes a stub call that bails out due to the length. Currently, the bailout
    code a) doesn't have the allocation site, and b) wouldn't use it if it did
    because the length is perceived to be too high.

    This CL passes the allocation site to the stub call (rather than undefined),
    and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1088423002

Cr-Commit-Position: refs/heads/master@{#27875}

Add missing Handle to GetOrCreatePrototypeChainValidityCell

Follow-up to 333219a745ca.

NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1095503002

Cr-Commit-Position: refs/heads/master@{#27874}

X87: VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

port 776770c0e4e9cffad408581962ca90f247ac66f0 (r27827).

original commit message:

  This needs "Pass load ic state through the Oracle"
  (https://codereview.chromium.org/1083933002/) to land first.

BUG=

Review URL: https://codereview.chromium.org/1093433004

Cr-Commit-Position: refs/heads/master@{#27873}

Enable Cell-based prototype chain checks

Review URL: https://codereview.chromium.org/1070253004

Cr-Commit-Position: refs/heads/master@{#27872}

Revert of Experiment: reduce heap growing factor to investigate OOM impact. (patchset #4 id:60001 of https://codereview.chromium.org/1060533003/)

Reason for revert:
Experiment done.

Original issue's description:
> Experiment: reduce heap growing factor to investigate OOM impact.
>
> This CL will be reverted after getting sufficient data.
> BUG=
>
> Committed: https://crrev.com/8b737395c8fcde35cbfbed6607f767ed48eefc5b
> Cr-Commit-Position: refs/heads/master@{#27804}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1085353003

Cr-Commit-Position: refs/heads/master@{#27871}

[turbofan] Clean up cached nodes in JSGraph.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1080023002

Cr-Commit-Position: refs/heads/master@{#27870}

Use atomic operation to read the length of a fixed array.

This fixes a race where
- mutator changes the fixed array length by trimming it,
- sweeper thread reads the length of the fixed array.

Also rename FROM_GC and FROM_MUTATOR to be more precise.

BUG=chromium:462908
LOG=NO

Review URL: https://codereview.chromium.org/1034163002

Cr-Commit-Position: refs/heads/master@{#27869}

Avoid evacuation of popular pages.

This breaks the (evacuation -> slots buffer overflow -> abort -> new GC -> evacuation) cycle for popular pages.

BUG=

Review URL: https://codereview.chromium.org/1037433002

Cr-Commit-Position: refs/heads/master@{#27868}

Revert of [x64] Use xorl to materialize smi zero. (patchset #1 id:1 of https://codereview.chromium.org/1085153002/)

Reason for revert:
Seems to cause performance regressions.

Original issue's description:
> [x64] Use xorl to materialize smi zero.
>
> Before we always loaded smi zero via a movabs with a 64-bit immediate,
> which is pretty expensive compared to the xorl.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/f236777bfe6e080ff1ead6baf847cc9b6bb4f9cb
> Cr-Commit-Position: refs/heads/master@{#27829}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:477592
LOG=n

Review URL: https://codereview.chromium.org/1059543004

Cr-Commit-Position: refs/heads/master@{#27867}

fix visiting of phantom handles that should be retained

BUG=

Review URL: https://codereview.chromium.org/1094473002

Cr-Commit-Position: refs/heads/master@{#27866}

Fix signed/unsigned compare in messages.cc

R=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1089363002

Cr-Commit-Position: refs/heads/master@{#27865}

Start migrating error message templates to the runtime.

Currently done with two templates, one used from native js, one from runtime.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1087633005

Cr-Commit-Position: refs/heads/master@{#27864}

[turbofan] Typed lowering requires typed nodes.

There's no point in checking whether a node is typed in JSTypedLowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1086303002

Cr-Commit-Position: refs/heads/master@{#27863}

[turbofan] Split ControlEquivalence implementation and add trace flag.

Split interface and implementation of ControlEquivalence and add a
dedicated trace flag --trace-turbo-ceq to make it reusable outside the
scheduler.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1056093005

Cr-Commit-Position: refs/heads/master@{#27862}

[turbofan] Make js-typed-lowering.h self contained.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1091723002

Cr-Commit-Position: refs/heads/master@{#27861}

Update V8 DEPS.

Rolling v8/tools/clang to 32e839da8bd2088ef23c3ea874d3c1cd04cd1384

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1093493002

Cr-Commit-Position: refs/heads/master@{#27860}

Revert "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"

This reverts commit 8c98cc074ef8278ce1c4dcd4790e8aaf6fbeedc6
because it causes flaky failures in the dromaeo.jslibeventprototype
benchmark on Linux/Windows and consistent failures on Android.

Also reverts the followup "Remove kForInStatementIsNotFastCase bailout reason"
(commit ba24e6769615d0ea7f7b5a31c5947769892f93a7) to avoid breaking the build.

BUG=chromium:476592
TBR=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1066663005

Cr-Commit-Position: refs/heads/master@{#27859}

Fix FormalParameterErrorLocations member names

R=arv@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1083953002

Cr-Commit-Position: refs/heads/master@{#27858}

Array() in optimized code can create with wrong ElementsKind in corner cases.

Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1086873003

Cr-Commit-Position: refs/heads/master@{#27857}

Revert of Simplify DoParseProgram (patchset #2 id:20001 of https://codereview.chromium.org/1058363003/)

Reason for revert:
[Sheriff] Changes some layout tests on all platforms, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2032/builds/2543

Original issue's description:
> Simplify DoParseProgram
>
> DoParseProgram doesn't appear to need to receive toplevel scopes as
> arguments; it can properly set the end_position of the scopes to the
> scanner's position after parsing is complete.
>
> R=marja@chromium.org
> BUG=
> LOG=N
>
> Committed: https://crrev.com/8da9252f61d3c499a78b0b94299c314b2eb0b0c8
> Cr-Commit-Position: refs/heads/master@{#27847}

TBR=marja@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1089623002

Cr-Commit-Position: refs/heads/master@{#27856}

Fix issues with name and length on poison pill function

In ES6 function name and length are configurable. However, the length
and name properties of the poison pill function must not be
configurable.

BUG=v8:4011
LOG=N
R=adamk@chromium.org, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1061393002

Cr-Commit-Position: refs/heads/master@{#27855}

Make BitsetType enum uint32_t to avoid narrowing warnings

enum defaults to signed on win, and kTagged has 1<<31 causing
warning.

Full errors:

d:\src\cr3\src\v8\src\types.cc(1259): error C2220: warning treated as error - no 'object' file generated
d:\src\cr3\src\v8\src\types.cc(1241): note: while compiling class template member function 'void v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset)'
d:\src\cr3\src\v8\src\types.cc(1283): note: see reference to function template instantiation 'void v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset)' being compiled
d:\src\cr3\src\v8\src\types.cc(1355): note: see reference to class template instantiation 'v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType' being compiled
d:\src\cr3\src\v8\src\types.cc(1259): warning C4838: conversion from 'int' to 'const v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(1259): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(323): warning C4838: conversion from '' to 'v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(323): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(315): note: while compiling class template static data member 'const v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::Boundary v8::internal::TypeImpl<v8::internal::ZoneTypeConfig>::BitsetType::BoundariesArray[]'
d:\src\cr3\src\v8\src\types.cc(1259): warning C4838: conversion from 'int' to 'const v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(1259): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(1241): note: while compiling class template member function 'void v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset)'
d:\src\cr3\src\v8\src\types.cc(1283): note: see reference to function template instantiation 'void v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Print(std::ostream &,v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset)' being compiled
d:\src\cr3\src\v8\src\types.cc(1359): note: see reference to class template instantiation 'v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType' being compiled
d:\src\cr3\src\v8\src\types.cc(323): warning C4838: conversion from '' to 'v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::bitset' requires a narrowing conversion
d:\src\cr3\src\v8\src\types.cc(323): note: to simplify migration, consider the temporary use of /Wv:18 flag with the version of the compiler with which you used to build without warnings
d:\src\cr3\src\v8\src\types.cc(315): note: while compiling class template static data member 'const v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::Boundary v8::internal::TypeImpl<v8::internal::HeapTypeConfig>::BitsetType::BoundariesArray[]'

LOG=N
R=jochen@chromium.org
BUG=440500

Review URL: https://codereview.chromium.org/1055933004

Cr-Commit-Position: refs/heads/master@{#27854}

Remove operator delete on VS2015 to avoid compiler bug

LOG=N
R=jochen@chromium.org
BUG=chromium:440500

Review URL: https://codereview.chromium.org/1084763002

Cr-Commit-Position: refs/heads/master@{#27853}

Makefile: introduce debugsymbols=on flag

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1085283002

Cr-Commit-Position: refs/heads/master@{#27852}

Reduce regexp compiler stack size when not optimizing regexps

R=jkummerow@chromium.org
BUG=chromium:475705
LOG=y

Review URL: https://codereview.chromium.org/1082763002

Cr-Commit-Position: refs/heads/master@{#27851}

PPC: VectorICs: megamorphic keyed loads in crankshaft don't need a vector.

Port c8e4d57d3b3036a05902f5b916cb5d853a57393c

Original commit message:
They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

R=mvstanton@chromium.org, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1085913003

Cr-Commit-Position: refs/heads/master@{#27850}

PPC: Use Cells to check prototype chain validity (disabled by default).

Port 0179ec57975c5063bbecd98e11cdda77ddad8996

Original commit message:
The cells are stored on prototypes (in their map's PrototypeInfo). When a prototype object changes its map, then both its own validity cell and those of all "downstream" prototypes are invalidated; handlers for a given receiver embed the currently valid cell for that receiver's prototype during their compilation and check it on execution.

R=michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1091563002

Cr-Commit-Position: refs/heads/master@{#27849}

Fix a few potential integer negation overflows

AFAICT none of these can actually be triggered currently; but it's still good to harden the code a little.

Review URL: https://codereview.chromium.org/1058533007

Cr-Commit-Position: refs/heads/master@{#27848}

Simplify DoParseProgram

DoParseProgram doesn't appear to need to receive toplevel scopes as
arguments; it can properly set the end_position of the scopes to the
scanner's position after parsing is complete.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1058363003

Cr-Commit-Position: refs/heads/master@{#27847}

[turbofan] Fix ForInStatement that deopts during filter.

This adds a missing bailout id to a ForInStatement for when retrieving
and filtering a property name deoptimizes. This can happen with proxies
that have a getPropertyDescriptor trap.

R=jarin@chromium.org
TEST=mjsunit/for-in-opt

Review URL: https://codereview.chromium.org/1086083002

Cr-Commit-Position: refs/heads/master@{#27846}

Use Cells to check prototype chain validity (disabled by default).

The cells are stored on prototypes (in their map's PrototypeInfo). When a prototype object changes its map, then both its own validity cell and those of all "downstream" prototypes are invalidated; handlers for a given receiver embed the currently valid cell for that receiver's prototype during their compilation and check it on execution.

Review URL: https://codereview.chromium.org/908213002

Cr-Commit-Position: refs/heads/master@{#27845}

VectorICs: recent changes broke cases with --novector-ics

Ensure that we protect turning off the vector ics flag.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1087213002

Cr-Commit-Position: refs/heads/master@{#27844}

[crankshaft] Add missing source position for calls.

R=verwaest@chromium.org
TEST=cctest/test-api
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1058553004

Cr-Commit-Position: refs/heads/master@{#27843}

[turbofan] cleanup ParallelMove

- make ParallelMove into a ZoneVector, removing an annoying level of indirection
- make MoveOperands hold InstructionOperands instead of pointers, so there's no more operand aliasing for moves
- opens up possibility of storing MachineType in allocated operands

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1081373002

Cr-Commit-Position: refs/heads/master@{#27842}

Retrieval of information by release channel

Polls omahaproxy for data about Chrome releases

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1063073003

Cr-Commit-Position: refs/heads/master@{#27841}

Make climit and jslimit stack limits atomic.

This fixes TSAN failure caused by race between:
 - optimizing compiler thread setting climit
 - and json parser reading climit in the main thread.

BUG=

Review URL: https://codereview.chromium.org/1031223004

Cr-Commit-Position: refs/heads/master@{#27840}

Reland "Wrap typed array implementations in functions."

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1090563002

Cr-Commit-Position: refs/heads/master@{#27839}

Abort incremental marking in test-heap/WeakCellsWithIncrementalMarking.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1089533002

Cr-Commit-Position: refs/heads/master@{#27838}

Correctly handle clearing of deprecated field types.

BUG=v8:4027
LOG=NO

Review URL: https://codereview.chromium.org/1086063003

Cr-Commit-Position: refs/heads/master@{#27837}

[turbofan] Add schedule to visualizer output

Review URL: https://codereview.chromium.org/985023002

Cr-Commit-Position: refs/heads/master@{#27836}

Put --noalways-opt flag back into regress-crbug-245480

This is a partial revert of 3eb277f270b9d41967e7ac208ec3fe8ef233761a.

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1087183002

Cr-Commit-Position: refs/heads/master@{#27835}

Revert of Force full GCwhenever CollectAllGarbage is meant to trigger a full GC. (patchset #4 id:60001 of https://codereview.chromium.org/1082973003/)

Reason for revert:
[Sheriff] Breaks http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3348 and maybe leads to timeouts/crashes on layout test bots:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064/builds/3002

Original issue's description:
> Force full GC whenever CollectAllGarbage is meant to trigger a full GC.
>
> Add a finalize incremental marking mode for CollectAllGarbage to finalize incremental marking when incremental marking is in progress, but we want a full gc at a given CollectAllGarbage call site.
>
> Default mode for CollectAllGarbage is finalize incremental marking and perform a full GC.
>
> BUG=
>
> Committed: https://crrev.com/9c105f0940ba757364ac18fcdf649815ec5ab2d1
> Cr-Commit-Position: refs/heads/master@{#27831}

TBR=ulan@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1088083002

Cr-Commit-Position: refs/heads/master@{#27834}

Remove support for specifying the number of available threads

The embedder can control how many threads it wants to use via the
v8::Platform implementation. V8 internally doesn't spin up threads
anymore. If the embedder doesn't want to use any threads at all, it's
v8::Platform implementation must either run the background jobs on
the foreground thread, or the embedder should specify --predictable

BUG=none
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1064723005

Cr-Commit-Position: refs/heads/master@{#27833}