The magic "print(i)" work-around was no longer work-arounding correctly,
so we do the right thing instead now.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1306843004 .

Cr-Commit-Position: refs/heads/master@{#30436}

This adds a %ToName runtime entry that uses the previously introduced
Object::ToName, which is based on the new Object::ToPrimitive method.
Also removes the need to expose ToName in various way via the builtins
and/or context.

Drive-by-fix: Let %HasProperty do the ToName conversion implicitly as
required.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319133002

Cr-Commit-Position: refs/heads/master@{#30435}

This is the first step towards a spec compliant ToPrimitive
implementation (and therefore spec compliant ToNumber, ToString,
ToName, and friends).  It adds support for the @@toPrimitive
symbol that was introduced with ES2015, and also adds the new
Symbol.prototype[@@toPrimitive] and Date.prototype[@@toPrimitive]
initial properties.

There are now runtime functions for %ToPrimitive, %ToNumber and
%ToString, which do the right thing and should be used as fallbacks
instead of the hairy runtime.js implementations.  I will do the
same for the other conversion operations mentioned by the spec in
follow up CLs.  Once everything is in place we can look into
optimizing things further, so that we don't always call into the
runtime.

Also fixed Date.prototype.toJSON to be spec compliant.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=y

Review URL: https://codereview.chromium.org/1306303003

Cr-Commit-Position: refs/heads/master@{#30434}

Reduce the number of entrypoints to the compiler pipeline by one. Always require caller to provide a CompilationInfo.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1317113004

Cr-Commit-Position: refs/heads/master@{#30433}

Also, polymorphic element stores have a slightly different shape for the array
attached to a vector slot. It's of the form [map, map, handler], where the 2nd
map is either a transition map or undefined (the maps are actually in
WeakCells).

Review URL: https://codereview.chromium.org/1316953003

Cr-Commit-Position: refs/heads/master@{#30432}

R=adamk@chromium.org
LOG=N
BUG=v8:4397

Review URL: https://codereview.chromium.org/1320673007

Cr-Commit-Position: refs/heads/master@{#30431}

Account for the constant pool pointer slot during register allocation
data initialization.

R=danno@chromium.org, titzer@chromium.org, bmeurer@chromium.org, mcilroy@chromium.org,
TEST=cctest/test-run-machops/RunSpillConstantsAndParameters
BUG=

Review URL: https://codereview.chromium.org/1317123003

Cr-Commit-Position: refs/heads/master@{#30430}

Float32x4, Int32x4, Uint32x4:
  store, store1, store2, store3

Int16x8, Int8x16, Uint16x8, Uint8x16:
  store

BUG=v8:4124
LOG=N

R=bbudge@chromium.org, littledan@chromium.org, jarin@chromium.org

Review URL: https://codereview.chromium.org/1304183004

Cr-Commit-Position: refs/heads/master@{#30429}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1322523004

Cr-Commit-Position: refs/heads/master@{#30428}

Remove CompilationInfo::MayUseThis() and replace it with what we really want to know: MustReplaceUndefinedReceiverWithGlobalProxy.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1312713004

Cr-Commit-Position: refs/heads/master@{#30427}

If JSON contains SyntaxError then V8 will report exception and won't report compile error.

LOG=Y
BUG=chromium:515382
R=yangguo@chromium.org,yurys@chromium.org

Review URL: https://codereview.chromium.org/1308123006

Cr-Commit-Position: refs/heads/master@{#30426}

Related to 1318893002 - another source of regressions in
benchmarks sensitive to compile time is the splintering
logic. This change addresses some, but not all, of that. In
particular, there are still some places (figuring out if a
range has a hole right where a deferred set of blocks is)
that need another look.

BUG=chromium:1318893002
LOG=n

Review URL: https://codereview.chromium.org/1319843002

Cr-Commit-Position: refs/heads/master@{#30425}

Port 5d975694

Original commit message:
    Adds support for parameters to the BytecodeArrayBuilder and BytecodeGenerator.
    Parameters are accessed as negative interpreter registers.

R=rmcilroy@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1308373003

Cr-Commit-Position: refs/heads/master@{#30424}

BUG=chromium:524425
LOG=n

Review URL: https://codereview.chromium.org/1314133004

Cr-Commit-Position: refs/heads/master@{#30423}

Float32x4, Int32x4, Uint32x4:
  load, load1, load2, load3

Int16x8, Int8x16, Uint16x8, Uint8x16:
  load

BUG=v8:4124
LOG=N

Review URL: https://codereview.chromium.org/1302133002

Cr-Commit-Position: refs/heads/master@{#30422}

R=machenbach@chromium.org
BUG=chromium:511311
LOG=N

Review URL: https://codereview.chromium.org/1312953002

Cr-Commit-Position: refs/heads/master@{#30421}

R=jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1318823006

Cr-Commit-Position: refs/heads/master@{#30420}

Port 5d875a57

Original commit message:
    The previous hack with HInstanceOfKnownGlobal was not only slower,
    but also very brittle and required a lot of weird hacks to support it. And
    what's even more important it wasn't even correct (because a map check
    on the lhs is never enough for instanceof).

    The new implementation provides a sane runtime implementation
    for InstanceOf plus a fast case in the InstanceOfStub, combined with
    a proper specialization in the case of a known global in CrankShaft,
    which does only the prototype chain walk (coupled with a code
    dependency on the known global).

    As a drive-by-fix: Also fix the incorrect Object.prototype.isPrototypeOf
    implementation.

R=bmeurer@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=v8:4376
LOG=n

Review URL: https://codereview.chromium.org/1314263002

Cr-Commit-Position: refs/heads/master@{#30419}

BUG=

Review URL: https://codereview.chromium.org/1319953003

Cr-Commit-Position: refs/heads/master@{#30418}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1305163008

Cr-Commit-Position: refs/heads/master@{#30417}

R=mstarzinger@chromium.org,yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1319003002

Cr-Commit-Position: refs/heads/master@{#30416}

BUG=

Review URL: https://codereview.chromium.org/1313383005

Cr-Commit-Position: refs/heads/master@{#30415}

Port 00df60d1

Original commit message:
    Makes the following modifications to the interpreter builtins and
    InterpreterAssembler:
     - Adds an accumulator register and initializes it to undefined()
     - Adds a register file pointer register and use it instead of FramePointer to
       access registers
     - Modifies builtin to support functions with 0 regiters in the register file
     - Modifies builtin to Call rather than TailCall to first bytecode handler.

R=rmcilroy@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1309113003

Cr-Commit-Position: refs/heads/master@{#30414}

Port 7fb31bdb

Original commit message:
    The simulator uses a separate JS stack, exhaustion of the C stack
    however is not caught by JS limit checks. This change now lowers the
    limit of the JS stack accordingly on function calls.

R=mstarzinger@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=chromium:522380
LOG=n

Review URL: https://codereview.chromium.org/1309303005

Cr-Commit-Position: refs/heads/master@{#30413}

R=hpayer@chromium.org
BUG=v8:1490
LOG=n

Review URL: https://codereview.chromium.org/1305163007

Cr-Commit-Position: refs/heads/master@{#30412}

BUG=chromium:525372
LOG=n

Review URL: https://codereview.chromium.org/1320893002

Cr-Commit-Position: refs/heads/master@{#30411}

- remove the Backing-Store specific code from builtins.cc and put it in elements.cc.
- adding tests to improve coverage of the splice method

BUG=

Review URL: https://codereview.chromium.org/1312033003

Cr-Commit-Position: refs/heads/master@{#30410}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1306043003

Cr-Commit-Position: refs/heads/master@{#30409}

This makes it clear that only components within the "heap" directory
should be friends with the Heap class. The two notable exceptions are
Factory and Isolate which represent external interfaces into the heap.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1320843002

Cr-Commit-Position: refs/heads/master@{#30408}

The CompactionSpace is temporarily used during compaction to hold migrated
objects. The payload is merged back into the corresponding space after
compaction.

Note the this is not the complete implementation and it is currently only used in a test.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1314493007

Cr-Commit-Position: refs/heads/master@{#30407}

BUG=v8:4280
LOG=N
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1319943002

Cr-Commit-Position: refs/heads/master@{#30406}

It has become obsolete since we do the name lookup at compile time.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1319893004

Cr-Commit-Position: refs/heads/master@{#30405}

Adds a (currently unused) constant_pool() field to BytecodeArray objects.
This field points to a FixedArray object which will be used to hold constants.

The BytecodeArray is now a mixed values object type, with the
kConstantPoolOffset object holding a tagged pointer, but the remainder of the
object holding raw bytes (which could look like tagged pointers but are not).
Modify the BytecodeArray GC visitors to deal with this and test that the
field is migrated properly when evacuated.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1314953004

Cr-Commit-Position: refs/heads/master@{#30404}

Adds support for parameters to the BytecodeArrayBuilder and BytecodeGenerator.
Parameters are accessed as negative interpreter registers.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1303403004

Cr-Commit-Position: refs/heads/master@{#30403}

R=bmeurer@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1316943002

Cr-Commit-Position: refs/heads/master@{#30402}

When vector based stores are on, we don't need to do this anymore.

BUG=

Review URL: https://codereview.chromium.org/1314433004

Cr-Commit-Position: refs/heads/master@{#30401}

A few benchmarks, e.g. Massive/SQLite, turn out to be
sensitive to compile time. Upon analysis, splinter merging
and then splinter creation (splitting) appear to be the main
contributors to such regressions. This change tackles main
sources of regression in Merging. Profiling SQLite shows,
after this change, Merging as noise (down from main C++
contributor of samples)

BUG=chromium:1318893002
LOG=n

Review URL: https://codereview.chromium.org/1318893002

Cr-Commit-Position: refs/heads/master@{#30400}

While the intention is to eventually do away with
FLAG_turbo_loop_stackcheck and FLAG_turbo_preprocess_range,
they are useful for the interim we are still testing and
benchmarking the feature.

Review URL: https://codereview.chromium.org/1314163003

Cr-Commit-Position: refs/heads/master@{#30399}

The zone type cache would be handy inside the asm.js typer.
Pulling it out into a seperate inlinable header to allow sharing.

BUG=https://code.google.com/p/v8/issues/detail?id=4203
TEST=None
R=andreas@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1307093006

Cr-Commit-Position: refs/heads/master@{#30398}

R=jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1315173004

Cr-Commit-Position: refs/heads/master@{#30397}