PPC: Remove unused jump_elimination_allowed parameter to Assembler::branch_offset().

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1233453007

Cr-Commit-Position: refs/heads/master@{#29584}

PPC: Remove separate construct stub for new.target users.

Port e50c861b099b3bd3e1174b5f2843567620cc6842

R=mstarzinger@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1230973006

Cr-Commit-Position: refs/heads/master@{#29583}

PPC: Debugger: use debug break slot to break on call.

Port 8965b683ce39bc3c24ed2466d189323d81a70852

Original commit message:
    Break point at calls are currently set via IC. To change this, we
    need to set debug break slots instead. We also need to distinguish
    those debug break slots as calls to support step-in.

    To implement this, we add a data field to debug break reloc info to
    indicate non-call debug breaks or in case of call debug breaks, the
    number of arguments. We can later use this to find the callee on the
    evaluation stack in Debug::PrepareStep.

R=yangguo@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1231173002

Cr-Commit-Position: refs/heads/master@{#29582}

MIPS: Check that branches to trampoline pool do actually reach.

Do the check in release mode, too. Prefer crash over mis-patched
branch instruction.

BUG=v8:4294
LOG=N

Review URL: https://codereview.chromium.org/1233623004

Cr-Commit-Position: refs/heads/master@{#29581}

Remove arv from OWNERS

Goodbyes are not forever.
Goodbyes are not the end.
They simply mean I’ll miss you
Until we meet again!
~Author Unknown

BUG=N
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1208423016

Cr-Commit-Position: refs/heads/master@{#29580}

Revert preallocating of descriptors since right now getters and setters cause copying of descriptor arrays

BUG=

Review URL: https://codereview.chromium.org/1225213008

Cr-Commit-Position: refs/heads/master@{#29579}

[es6] Handle conflicts for sloppy let

We have to call CheckConflictingVarDeclarations in case we have enabled
--harmony-sloppy

BUG=v8:4287
LOG=N
R=littledan@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1226103002

Cr-Commit-Position: refs/heads/master@{#29578}

[es6] Enforce TDZ checks for let/const in StoreLookupSlot

With --harmony-sloppy we can get to a runtime store in the presence of
an eval. We therefor need to check that the value is not the hole which
is used to enforce TDZ.

BUG=v8:4284
LOG=N
R=rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1214733013

Cr-Commit-Position: refs/heads/master@{#29577}

Fix keyed access of primitive objects in the runtime.
For now it uses a pretty slow path for accessing strings by wrapping it into a new temporary wrapper.

BUG=v8:4042, v8:3088
LOG=y

Review URL: https://codereview.chromium.org/1221303019

Cr-Commit-Position: refs/heads/master@{#29576}

Update the context if Set on slow-mode argument targets an aliased arguments entry

BUG=v8:4177
LOG=n

Review URL: https://codereview.chromium.org/1233493007

Cr-Commit-Position: refs/heads/master@{#29575}

Use entry rather than index in ElementsAccessor::Get

BUG=v8:4137, v8:4177
LOG=n

Review URL: https://codereview.chromium.org/1230213002

Cr-Commit-Position: refs/heads/master@{#29574}

Change and simplify RelocInfo format.
 - we now have 6 bits to store RelocInfo mode.
 - removed a redundant tag byte per long reloc info entry.
 - renamed methods to be more precise.

Review URL: https://codereview.chromium.org/1230183002

Cr-Commit-Position: refs/heads/master@{#29573}

[test] Let perf runner interleave try executions.

This allows running two executables interleaved to reduce
flakiness of tryjobs. The executables must reside in
different out directories.

BUG=chromium:507213
LOG=n
NOTRY=true
TEST=python -m unittest run_perf_test

Review URL: https://codereview.chromium.org/1215273003

Cr-Commit-Position: refs/heads/master@{#29572}

Use entry rather than index in ElementsAccessor::Set

BUG=v8:4137,v8:4177
LOG=n

Review URL: https://codereview.chromium.org/1232463005

Cr-Commit-Position: refs/heads/master@{#29571}

Reload the map of typed arrays after performing ToNumber.

BUG=chromium:507980
LOG=n

Review URL: https://codereview.chromium.org/1234553002

Cr-Commit-Position: refs/heads/master@{#29570}

Updated version to 4.6

BUG=
TBR=machenbach@chromium.org,vogelheim@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1235573002

Cr-Commit-Position: refs/heads/master@{#29569}

Debugger: record reloc info for debug break slot immediate before the slot.

If we do it too early, we might get a constant pool between the reloc info
and the actual slot.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1229673005

Cr-Commit-Position: refs/heads/master@{#29568}

[arm64] Fixed unnecessary environment assignment to LSmiTag instruction.

BUG=chromium:490021
LOG=N

Review URL: https://codereview.chromium.org/1235563002

Cr-Commit-Position: refs/heads/master@{#29567}

Fixes the parser-shell by adding a dependency to StartupDataUtil.

Review URL: https://codereview.chromium.org/1230173002

Cr-Commit-Position: refs/heads/master@{#29566}

Disable the pending task if the memory reducer is torn down.

BUG=chromium:508584
LOG=NO

Review URL: https://codereview.chromium.org/1230163002

Cr-Commit-Position: refs/heads/master@{#29565}

Remove more uses of the deprecated EnumSet template class.

EnumtSet has been deprecated for quite some time, and replaced with the
more general and type safe base::Flags template class.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1229233002

Cr-Commit-Position: refs/heads/master@{#29564}

[Sheriff] Skip worker test.

BUG=v8:4279
LOG=n
NOTRY=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1235493005

Cr-Commit-Position: refs/heads/master@{#29563}

Remove separate construct stub for new.target users.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1213623020

Cr-Commit-Position: refs/heads/master@{#29562}

Debugger: use debug break slot to break on call.

Break point at calls are currently set via IC. To change this, we
need to set debug break slots instead. We also need to distinguish
those debug break slots as calls to support step-in.

To implement this, we add a data field to debug break reloc info to
indicate non-call debug breaks or in case of call debug breaks, the
number of arguments. We can later use this to find the callee on the
evaluation stack in Debug::PrepareStep.

BUG=v8:4269
R=ulan@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1222093007

Cr-Commit-Position: refs/heads/master@{#29561}

[Sheriff] Mark test as flaky.

BUG=v8:4279
LOG=n
NOTRY=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1233603002

Cr-Commit-Position: refs/heads/master@{#29560}

Fix lazy compilation of eval() under nosnap/--use-strict

When running without a snapshot, the GlobalEval function gets lazy compiled.
By the time we compile it, its name is "eval", which causes the parser to
choke (functions named "eval" aren't allowed in strict mode!).

Instead, we now always skip checking the function name when lazy-parsing,
as the name has already been checked appropriately by the preparser.

Also cleaned up other cases that don't require name checking by introducing
FunctionNameValidity enum and passing appropriate values throughout the
parser and preparser.

This lets us pass an additional 18 test262 tests.

BUG=v8:4198
LOG=n

Review URL: https://codereview.chromium.org/1227093005

Cr-Commit-Position: refs/heads/master@{#29559}

[es6] Bound function name

Instead of updating the SharedFuntionInfo set the name property on
the function directly.

BUG=v8:4278
LOG=N
R=verwaest@chromium.org, littledan@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1227523003

Cr-Commit-Position: refs/heads/master@{#29558}

d8 workers: fix race on quit() with context_mutex_

When quit() is called, d8 shell exits without cleanup. If a worker is running,
it might be holding the context_mutex_, which if destroyed will DCHECK.

BUG=4279
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1231473002

Cr-Commit-Position: refs/heads/master@{#29557}

[es6] Function bind should preserve [[Prototype]]

The function returned from Function.prototype.bind should have the same
[[Prototype]] as the receiver.

BUG=v8:3889
LOG=N
R=adamk@chromium.org, verwaest@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1217603005

Cr-Commit-Position: refs/heads/master@{#29556}

Landmine to cleanup windows.

Cr-Commit-Position: refs/heads/master@{#29555}

[test] Raise timeout for testing without vfp3.

TBR=bmeurer@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1228073002

Cr-Commit-Position: refs/heads/master@{#29554}

Whitespace change to test ninja on windows.

Cr-Commit-Position: refs/heads/master@{#29553}

[arm] Don't call branch_offset within CheckConstPool.

This basically means that we must not use the b(Label*) version here,
but the b(int) version instead to jump over the constant pool.

BUG=v8:4292
LOG=y

Review URL: https://codereview.chromium.org/1224243002

Cr-Commit-Position: refs/heads/master@{#29552}

Add goma=on option to Makefile build.

Review URL: https://codereview.chromium.org/1225683010

Cr-Commit-Position: refs/heads/master@{#29551}

[arm] Fix missing CheckBuffer for branches.

The b, bl and blx methods that take labels basically ignore the constant
pool check and just block the constant pool for the next instruction.
This way a long enough sequence of those instructions will block can
potentially block the constant pool emission for too long.

BUG=v8:4292
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1223093004

Cr-Commit-Position: refs/heads/master@{#29550}

Allow deferred handle dereference in EmitLoadRegister to retrieve number.

R=mstarzinger@chromium.org
BUG=chromium:507977
LOG=N

Review URL: https://codereview.chromium.org/1230653004

Cr-Commit-Position: refs/heads/master@{#29549}

[turbofan] Use NumAllocatableRegisters() instead of kMaxNumAllocatableRegisters.

Use NumAllocatableRegisters() instead of kMaxNumAllocatableRegisters in
ArchDefaultRegisterConfiguration::ArchDefaultRegisterConfiguration()
otherwise the compiler DCHECKS if triggered during snapshot builds on
Arm where only 16 DoubleRegisters are avaiable instead of 32.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1230473006

Cr-Commit-Position: refs/heads/master@{#29548}

[arm] Remove unused jump_elimination_allowed parameter to Assembler::branch_offset().

That parameter is just confusing and completely unused.

Review URL: https://codereview.chromium.org/1228763003

Cr-Commit-Position: refs/heads/master@{#29547}

Debugger: do not compile IC for accessors when debugging.

The invariant is that as long as there is a debug info on
the shared function info, no accessor IC is compiled for
its code. That way we can guarantee that stepping into
accessors, which requires a debug info, works for accessors.

Review URL: https://codereview.chromium.org/1220283009

Cr-Commit-Position: refs/heads/master@{#29546}

Guard @@isConcatSpreadable behind a flag

The breakage to Chrome seems to be based on @@isConcatSpreadable
and turning that part off with this patch fixes the Maps Tips & Tricks
test case.

BUG=chromium:507553
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1226063002

Cr-Commit-Position: refs/heads/master@{#29545}

Revert of [turbofan] Optimize string "length" property access based on types. (patchset #2 id:20001 of https://codereview.chromium.org/1216593003/)

Reason for revert:
Causes crash when running benchmarks/octane/regexp.js on ARM:
http://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/2492/steps/Benchmarks/logs/regexp

Original issue's description:
> [turbofan] Optimize string "length" property access based on types.
>
> Optimize string "length" property access based on static type
> information if possible, but also optimistically optimize the access
> based on type feedback from the LoadIC.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40
> Cr-Commit-Position: refs/heads/master@{#29543}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1224083002

Cr-Commit-Position: refs/heads/master@{#29544}

[turbofan] Optimize string "length" property access based on types.

Optimize string "length" property access based on static type
information if possible, but also optimistically optimize the access
based on type feedback from the LoadIC.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1216593003

Cr-Commit-Position: refs/heads/master@{#29543}

PPC: Add unoptimized/optimized variants of MathFloor TF code stub

Port 8f13b655b8a10dae2116dd18b32f09337bb2d410

Original commit message:
    - Add a TurboFanIC class, derived from TurboFanCodeStub, that
      automatically distinguishes between versions of the IC called from
      optimized and unoptimized code.
    - Add appropriate InterfaceDescriptors for both the versions of the
      stub called from unoptimized and optimized code
    - Change the MathFloor TF stub generator to output either the
      for-optimized or for-unoptimized version based on the minor_key
      parameter.

R=danno@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1207253003

Cr-Commit-Position: refs/heads/master@{#29542}

Fix cluster-fuzz found regression with d8 Workers

This one occurred when serializing an object. When the property getter threw an
exception, that value was skipped, but the property count wasn't updated. The
deserializer then tried to deserialize the wrong value.

BUG=chromium:506549
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1220193004

Cr-Commit-Position: refs/heads/master@{#29541}

[es6] unship harmony_rest_parameters

BUG=508074
LOG=N
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1222713013

Cr-Commit-Position: refs/heads/master@{#29540}

Reland: Add unoptimized/optimized variants of MathFloor TF code stub

- Add a TurboFanIC class, derived from TurboFanCodeStub, that
  automatically distinguishes between versions of the IC called from
  optimized and unoptimized code.
- Add appropriate InterfaceDescriptors for both the versions of the
  stub called from unoptimized and optimized code
- Change the MathFloor TF stub generator to output either the
  for-optimized or for-unoptimized version based on the minor_key
  parameter.

Committed: https://crrev.com/8f13b655b8a10dae2116dd18b32f09337bb2d410
Cr-Commit-Position: refs/heads/master@{#29534}

Review URL: https://codereview.chromium.org/1225943002

Cr-Commit-Position: refs/heads/master@{#29539}

Verify that double unboxing is never performed on large objects.

BUG=

Review URL: https://codereview.chromium.org/1214673007

Cr-Commit-Position: refs/heads/master@{#29538}

[test] Skip rest-params test.

BUG=chromium:508074
LOG=n
NOTREECHECKS=true
NOTRY=true
TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/1215023016

Cr-Commit-Position: refs/heads/master@{#29537}

[es6] Initial support for let/const bindings in sloppy mode

Allow let in sloppy mode with --harmony-sloppy

Allow ES'15 const in sloppy mode with --harmony-sloppy --no-legacy-const

Functions in block are not done yet. They are only let bound in the block
at this point.

BUG=v8:3305, v8:2198
LOG=N
R=littledan@chromium.org, rossberg@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1219853004

Cr-Commit-Position: refs/heads/master@{#29536}

Revert of Add unoptimized/optimized variants of MathFloor TF code stub (patchset #4 id:60001 of https://codereview.chromium.org/1225943002/)

Reason for revert:
Failure on compiling runtime.js on windows

Original issue's description:
> Add unoptimized/optimized variants of MathFloor TF code stub
>
> - Add a TurboFanIC class, derived from TurboFanCodeStub, that
>   automatically distinguishes between versions of the IC called from
>   optimized and unoptimized code.
> - Add appropriate InterfaceDescriptors for both the versions of the
>   stub called from unoptimized and optimized code
> - Change the MathFloor TF stub generator to output either the
>   for-optimized or for-unoptimized version based on the minor_key
>   parameter.
>
> Committed: https://crrev.com/8f13b655b8a10dae2116dd18b32f09337bb2d410
> Cr-Commit-Position: refs/heads/master@{#29534}

TBR=mvstanton@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1220783006

Cr-Commit-Position: refs/heads/master@{#29535}

Add unoptimized/optimized variants of MathFloor TF code stub

- Add a TurboFanIC class, derived from TurboFanCodeStub, that
  automatically distinguishes between versions of the IC called from
  optimized and unoptimized code.
- Add appropriate InterfaceDescriptors for both the versions of the
  stub called from unoptimized and optimized code
- Change the MathFloor TF stub generator to output either the
  for-optimized or for-unoptimized version based on the minor_key
  parameter.

Review URL: https://codereview.chromium.org/1225943002

Cr-Commit-Position: refs/heads/master@{#29534}

PPC: [turbofan] Add TruncationMode for TruncateFloat64ToInt32.

Port 4b38c15817033ccd9a65efbb3d038ae2423293c2

Original commit message:
    We actually need round to zero truncation to implement the counterpart
    of LDoubleToI in TurboFan, which tries to convert a double to an integer
    as required for keyed load/store optimizations.

    Drive-by-cleanup: Reduce some code duplication in the InstructionSelector
    implementations.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1220373003

Cr-Commit-Position: refs/heads/master@{#29533}

Disable harmony/arrow-rest-params test to unblock landing of another CL.

BUG=chromium:508074
LOG=N

Review URL: https://codereview.chromium.org/1217493005

Cr-Commit-Position: refs/heads/master@{#29532}

[test] Refactoring - Make perf suite definitions stateless regarding measurements.

This prepares for making multiple measurements of one trace.
For this, the suite/trace configurations need to be
independent of the measurement instances.

BUG=chromium:507213
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1227033002

Cr-Commit-Position: refs/heads/master@{#29531}

Fixed a couple of proxies-related unhandled exceptions.

BUG=chromium:506956, chromium:505907
LOG=N

Review URL: https://codereview.chromium.org/1215463012

Cr-Commit-Position: refs/heads/master@{#29530}

[x64] Fix handling of Smi constants in LSubI and LBitI

Smi immediates are not supported, so instructions with Smi representations need their constants in a register. LAddI has already been doing this. The manifestation of the bug was that an operation would compute 0 instead of the correct result.

BUG=chromium:478612
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1224623017

Cr-Commit-Position: refs/heads/master@{#29529}

Partially revert r29468

BUG=chromium:507767
LOG=n

Review URL: https://codereview.chromium.org/1224853003

Cr-Commit-Position: refs/heads/master@{#29528}

[turbofan] Add TruncationMode for TruncateFloat64ToInt32.

We actually need round to zero truncation to implement the counterpart
of LDoubleToI in TurboFan, which tries to convert a double to an integer
as required for keyed load/store optimizations.

Drive-by-cleanup: Reduce some code duplication in the InstructionSelector
implementations.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1225993002

Cr-Commit-Position: refs/heads/master@{#29527}

Add a flag for legacy const semantics

This flag is on by default but it will allow us to turn that off in
favor of harmony-sloppy in the future.

BUG=v8:3305, v8:2198
LOG=N
R=littledan@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1218803006

Cr-Commit-Position: refs/heads/master@{#29526}

Revert of [d8] bounds-check before getting Shell::Worker internal field (patchset #4 id:80001 of https://codereview.chromium.org/1214053004/)

Reason for revert:
[Sheriff] Fails here:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4737

Original issue's description:
> [d8] bounds-check before getting Shell::Worker internal field
>
> Prevents fatal error in debug builds
>
> BUG=v8:4271
> R=binji@chromium.org
> LOG=N
>
> Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
> Cr-Commit-Position: refs/heads/master@{#29524}

TBR=binji@chromium.org,jochen@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4271

Review URL: https://codereview.chromium.org/1215333012

Cr-Commit-Position: refs/heads/master@{#29525}

[d8] bounds-check before getting Shell::Worker internal field

Prevents fatal error in debug builds

BUG=v8:4271
R=binji@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29524}

Add debug-stepnext test for for-let loops

Review URL: https://codereview.chromium.org/1215383002

Cr-Commit-Position: refs/heads/master@{#29523}

[turbofan] VisitSuperCallReference is not reachable

BUG=N
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1226443004

Cr-Commit-Position: refs/heads/master@{#29522}

Delete from non-array end by trimming the backing store

Review URL: https://codereview.chromium.org/1218663009

Cr-Commit-Position: refs/heads/master@{#29521}

Use FullCodeGenerator::EmitGlobalVariableLoad() where possible to avoid code duplication.

Review URL: https://codereview.chromium.org/1222203007

Cr-Commit-Position: refs/heads/master@{#29520}

[turbofan] Move RawMachineAssembler back to src/compiler.

The RawMachineAssembler will be used to build the interpreter, so it needs
to move back to src/compiler.

This reverts commit b5b00cc031c15263bbc4e8e8b2bef01b6fdfd284.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1221303014

Cr-Commit-Position: refs/heads/master@{#29519}

Debugger: clear ICs on activating step-in to correctly flood accessor pairs.

If we compile handlers to call accessors, Debug::HandleStepIn won't get
called. Therefore we need to clear ICs each time. This has not been
necessary before because we used to patch ICs for breaking, and restored
them with cleared ICs. This is no longer the case. We do not use ICs
for breaking anymore, so they are not implicitly cleared any longer.

R=mvstanton@chromium.org
BUG=v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1212253009

Cr-Commit-Position: refs/heads/master@{#29518}

[test262-es6] Update to 2015-07-06 which includes the yaml harness fix

Revert "Revert of [test262-es6] Update to 2011-06-29 (patchset #1 id:1 of https://codereview.chromium.org/1220793005/)"

This reverts commit f50fff57b0b86c12b832c43d31458890617ebd88.

BUG=N
LOG=N
R=littledan@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1212723004

Cr-Commit-Position: refs/heads/master@{#29517}

[turbofan] Unify various bailout hacks for super call.

This removes various boilouts for super constructor calls from the
TurboFan pipeline and unifies them. It also disables and optimization
which breaks references to uninitialized const this variables.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1222843004

Cr-Commit-Position: refs/heads/master@{#29516}

Start incremental marking in long idle notification for background tab
disregarding the allocation throughput.

BUG=chromium:506132
LOG=NO

Review URL: https://codereview.chromium.org/1213313004

Cr-Commit-Position: refs/heads/master@{#29515}

Index -> Entry and Key -> Index in elements.[cc|h]

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1224643004

Cr-Commit-Position: refs/heads/master@{#29514}

[test] Turn off certificate verification when downloading test data on windows.

BUG=v8:4254
LOG=n
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1220333004

Cr-Commit-Position: refs/heads/master@{#29513}

Reland "Replace reduce-memory mode in idle notification with delayed clean-up GC."

This reverts commit 269918927a54cd1533ef4e3318dd76b3747762b5.
This reverts commit 435b3c873ac3b58fb56a1b7292951810c93ceda5.

The failing test is fixing in chromium.

BUG=chromium:490559
LOG=NO
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1208993009

Cr-Commit-Position: refs/heads/master@{#29512}

Move compatible receiver check from CompileHandler to UpdateCaches

We also need to do the check before using an existing handler from the
cache

BUG=chromium:505374
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1221433010

Cr-Commit-Position: refs/heads/master@{#29511}

[test] Fix redirect problem for downloading test data on windows.

BUG=v8:4254
LOG=n
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1219013007

Cr-Commit-Position: refs/heads/master@{#29510}

Cleanup frame description constant.

This unifies the existing frame constants that are the same accross all
architectures. It also adds a new kOriginalConstructorOffset constant
for construct frames and uses is in full-codegen.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1220223005

Cr-Commit-Position: refs/heads/master@{#29509}

X87: Debugger: use debug break slots instead of ICs (except for calls).

port a8a4c364c2ad4c1e5f4c6e1f1580d75ff1a35a4f (r29487).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1227603002

Cr-Commit-Position: refs/heads/master@{#29508}

[deoptimizer] Properly evict TurboFan OSR code objects on eager deopts.

TurboFan OSR installs the CompileOptimized builtin on JSFunctions, which
means that we never evict the OSR code objects for such functions from
eager deopts.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1220813018

Cr-Commit-Position: refs/heads/master@{#29507}

Revert of Fix bug when transferring SharedArrayBuffer to multiple Workers. (patchset #3 id:40001 of https://codereview.chromium.org/1215233004/)

Reason for revert:
[Sheriff] Test hangs sometimes and times out flakily. E.g.: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosse3/builds/4551/steps/Check%20%28flakes%29/logs/d8-worker-sharedarray..

Original issue's description:
> Fix bug when transferring SharedArrayBuffer to multiple Workers.
>
> Previously, the serialization code would call Externalize for every transferred
> ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If
> the buffer is already externalized, we should call GetContents instead.
>
> Also fix use-after-free bug when transferring ArrayBuffers. The transferred
> ArrayBuffer must be internalized in the new isolate, or be managed by the
> Shell. The current code gives it to the isolate externalized and frees it
> immediately afterward when the SerializationData object is destroyed.
>
> BUG=chromium:497295
> R=jarin@chromium.org
> LOG=n
>
> Committed: https://crrev.com/dd7962bf7838f8379ba776ee6b7b0e4d3bec2140
> Cr-Commit-Position: refs/heads/master@{#29499}

TBR=jarin@chromium.org,jochen@chromium.org,binji@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:497295

Review URL: https://codereview.chromium.org/1224843008

Cr-Commit-Position: refs/heads/master@{#29506}

Update V8 DEPS.

Rolling v8/third_party/icu to c81a1a3989c3b66fa323e9a6ee7418d7c08297af

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1213043007

Cr-Commit-Position: refs/heads/master@{#29505}

X87: [turbofan] Enable tail calls for %_CallRuntime.

port 1fa4285e1ce16cfadf8c40a0993491ec4e2bbbe0 (r29436).

original commit message:

    This involves:
    - Enabling the tail call optimization reducer in all cases.
    - Adding an addition flag to CallFunctionParameters to mark call sites
      that can be tail-called enabled.
    - Only set the tail-call flag for %_CallFunction.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1228463003

Cr-Commit-Position: refs/heads/master@{#29504}

PPC: Debugger: use debug break slots instead of ICs (except for calls).

Port a8a4c364c2ad4c1e5f4c6e1f1580d75ff1a35a4f

R=yangguo@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1216863005

Cr-Commit-Position: refs/heads/master@{#29503}

PPC: Fix "Support for global var shortcuts in script contexts."

R=ishell@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1212343007

Cr-Commit-Position: refs/heads/master@{#29502}

PPC: Fix "[turbofan] Add Uint64LessThanOrEqual to 64-bit TurboFan backends."

R=titzer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1218073008

Cr-Commit-Position: refs/heads/master@{#29501}

[turbofan] Port initialization of new.target variable.

This implements the proper initialization of the new.target internal
variable in the AstGraphBuilder. For now this uses a runtime call that
cannot handle inlined frames correctly.

R=arv@chromium.org

Review URL: https://codereview.chromium.org/1212813008

Cr-Commit-Position: refs/heads/master@{#29500}

Fix bug when transferring SharedArrayBuffer to multiple Workers.

Previously, the serialization code would call Externalize for every transferred
ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If
the buffer is already externalized, we should call GetContents instead.

Also fix use-after-free bug when transferring ArrayBuffers. The transferred
ArrayBuffer must be internalized in the new isolate, or be managed by the
Shell. The current code gives it to the isolate externalized and frees it
immediately afterward when the SerializationData object is destroyed.

BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1215233004

Cr-Commit-Position: refs/heads/master@{#29499}

Support for global var shortcuts in script contexts.

Review URL: https://codereview.chromium.org/1218783005

Cr-Commit-Position: refs/heads/master@{#29498}

Revert of Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1225793002/)

Reason for revert:
This will prevent rolls. Fixing the root issue instead.

Original issue's description:
> Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1195983002/)
>
> Reason for revert:
> Incorrect behavior
>
> Original issue's description:
> > [es6] Bound function names
> >
> > https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
> >
> > Bound functions should have a name based on the function that was
> > bound.
> >
> > This reverts the revert f2747ed9b48d0e62c7a30da69825ff926aeedbd2. The original
> > CL was reverted because the Blink layout test broke. I have a CL that disables
> > these tests at: https://codereview.chromium.org/1196753003/
> >
> > BUG=N
> > LOG=N
> > R=adamk
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/b6d950c979f4348138de0ec54e40dcc48d833926
> > Cr-Commit-Position: refs/heads/master@{#29193}
>
> TBR=adamk@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=N
>
> Committed: https://crrev.com/744e4d4fd9316674682bc6ca30ded5866494cc1c
> Cr-Commit-Position: refs/heads/master@{#29495}

TBR=adamk@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1222363002

Cr-Commit-Position: refs/heads/master@{#29497}

Fix performance regression introduced in r28961

where bound functions' length was made configurable. The bootstrapper must be kept in sync to avoid polymorphism.

BUG=chromium:500686
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1221383003

Cr-Commit-Position: refs/heads/master@{#29496}

Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1195983002/)

Reason for revert:
Incorrect behavior

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> This reverts the revert f2747ed9b48d0e62c7a30da69825ff926aeedbd2. The original
> CL was reverted because the Blink layout test broke. I have a CL that disables
> these tests at: https://codereview.chromium.org/1196753003/
>
> BUG=N
> LOG=N
> R=adamk
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/b6d950c979f4348138de0ec54e40dcc48d833926
> Cr-Commit-Position: refs/heads/master@{#29193}

TBR=adamk@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1225793002

Cr-Commit-Position: refs/heads/master@{#29495}

Revert of Reland: Fix logic for incremental marking steps on tenured allocation (patchset #4 id:60001 of https://codereview.chromium.org/1077153004/)

Reason for revert:
[Sheriff] Speculative revert, see:
https://code.google.com/p/chromium/issues/detail?id=506875

Original issue's description:
> Reland: Fix logic for incremental marking steps on tenured allocation
>
> BUG=
>
> Committed: https://crrev.com/5000650bde2ec0bc90d959b529c97aea20385043
> Cr-Commit-Position: refs/heads/master@{#29442}

TBR=hpayer@chromium.org,erikcorry@chromium.org
BUG=chromium:506875
LOG=n
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1212063005

Cr-Commit-Position: refs/heads/master@{#29494}

[turbofan] Context specialization is the job of the JSContextSpecialization.

Remove the context specialization hack from the AstGraphBuilder, and
properly specialize to the function context in the context specialization.
And replace the correct context in the JSInliner.

R=mstarzinger@chromium.org
BUG=v8:4273
LOG=n

Review URL: https://codereview.chromium.org/1218873005

Cr-Commit-Position: refs/heads/master@{#29493}

[test] Push binaries to separate folders on Android devices.

BUG=chromium:507213
LOG=n
NOTRY=true
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1213613005

Cr-Commit-Position: refs/heads/master@{#29492}

[test] Add android perf trybots.

BUG=chromium:502176
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1217503008

Cr-Commit-Position: refs/heads/master@{#29491}

[turbofan] Fix value output count for the Start node.

The value output count for Start is currently off by 1 for code stubs,
because the CommonOperatorBuilder hardcodes the receiver parameter.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1217553005

Cr-Commit-Position: refs/heads/master@{#29490}

[test] Port clobber of old test262 archive files.

BUG=v8:4254
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1226803002

Cr-Commit-Position: refs/heads/master@{#29489}

[turbofan] Cleanup Parameter creation in AstGraphBuilder.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1222833002

Cr-Commit-Position: refs/heads/master@{#29488}

Debugger: use debug break slots instead of ICs (except for calls).

BUG=v8:3147,v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1218493005

Cr-Commit-Position: refs/heads/master@{#29487}

[turbofan] Reland "Add new JSFrameSpecialization reducer." and "Perform OSR deconstruction early and remove type propagation.".

We have to reland these two commits at once, because the first breaks
some asm.js benchmarks without the second. The change was reverted
because of bogus checks in the verifier, which will not work in the
presence of OSR (and where hidden because of the type back propagation
hack in OSR so far). Original messages are below:

[turbofan] Add new JSFrameSpecialization reducer.

The JSFrameSpecialization specializes an OSR graph to the current
unoptimized frame on which we will perform the on-stack replacement.
This is used for asm.js functions, where we cannot reuse the OSR
code object anyway because of context specialization, and so we could as
well specialize to the max instead.

It works by replacing all OsrValues in the graph with their values
in the JavaScriptFrame.

The idea is that using this trick we get better performance without
doing the unsound backpropagation of types to OsrValues later. This
is the first step towards fixing OSR for TurboFan.

[turbofan] Perform OSR deconstruction early and remove type propagation.

This way we don't have to deal with dead pre-OSR code in the graph
and risk optimizing the wrong code, especially we don't make
optimistic assumptions in the dead code that leaks into the OSR code
(i.e. deopt guards are in dead code, but the types propagate to OSR
code via the OsrValue type back propagation).

BUG=v8:4273
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1226673005

Cr-Commit-Position: refs/heads/master@{#29486}

unicode-decoder: fix out-of-band write in utf16

`WriteUtf16Slow` should not assume that the output buffer has enough
bytes to hold both words of surrogate pair. It should pass the number of
remaining bytes to the `Utf8::ValueOf` instead, just as we already do in
`Utf8DecoderBase::Reset`. Otherwise it will attempt to write the trail
uint16_t past the buffer boundary, leading to memory corruption and
possible crash.

Originally reported by: Kris Reeves <kris.re@bbhmedia.com>

BUG=v8:4274
R=danno
R=svenpanne
LOG=y

Review URL: https://codereview.chromium.org/1226493003

Cr-Commit-Position: refs/heads/master@{#29485}