Currently does super.prop (load) and super.method() (call). Like full
codegen it uses runtime calls to load the property value.

BUG=v8:3330
LOG=N
R=mstarzinger@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1149133005

Cr-Commit-Position: refs/heads/master@{#28815}

We should not skip holes for these 2 functions.

BUG=v8:3895
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1165003005

Cr-Commit-Position: refs/heads/master@{#28814}

This in turn allows usage of AdvancedReducer::ReplaceWithValue which
has access to the underlying graph reducer. It will allow us to deal
with exception continuations correctly.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1158273011

Cr-Commit-Position: refs/heads/master@{#28813}

Only optimized for TF

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1146963002

Cr-Commit-Position: refs/heads/master@{#28812}

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1160253010

Cr-Commit-Position: refs/heads/master@{#28811}

This allows any AdvancedReducer to remove exception projections from
graphs. This is the common case when JS-operators are being replaced
with pure values. The old NodeProperties::ReplaceWithValue is being
deprecated in favor of AdvancedReducer::ReplaceWithValue.

R=titzer@chromium.org
TEST=unittests/AdvancedReducerTest

Review URL: https://codereview.chromium.org/1168693002

Cr-Commit-Position: refs/heads/master@{#28810}

BUG=chromium:496013
LOG=N

Review URL: https://codereview.chromium.org/1163203002

Cr-Commit-Position: refs/heads/master@{#28809}

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1163523008

Cr-Commit-Position: refs/heads/master@{#28808}

Rolling v8/third_party/icu to 9939a5d5314b6d59d5fb070902d73304c2482f88

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1168573003

Cr-Commit-Position: refs/heads/master@{#28807}

We used to only store the uses_super_property in the preparse data
logger. Let the logger use NeedsHomeObject instead.

BUG=v8:3768
LOG=N
R=wingo, adamk

Review URL: https://codereview.chromium.org/1164073003

Cr-Commit-Position: refs/heads/master@{#28806}

Also stages ES6 @@isConcatSpreadable support.

BUG=v8:3578
LOG=y

Review URL: https://codereview.chromium.org/1148983006

Cr-Commit-Position: refs/heads/master@{#28805}

Blink's DOM bindings are not yet ready.

BUG=493137, 239915
LOG=N
R=rossberg, adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1153263004

Cr-Commit-Position: refs/heads/master@{#28804}

This patch re-commits a previous commit after fixing a test to not
run into another known bug.
This reverts commit b104a67e.

This patch implements the last two methods on TypedArrays. These
were previously committed and led to a test failure.

BUG=v8:3578
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1159663004

Cr-Commit-Position: refs/heads/master@{#28803}

Before this we had 3 super related lexical bindings that got injected
into method bodies: .home_object, .this_function,  and new.target.
With this change we get rid of the .home_object one in favor of using
.this_function[home_object_symbol] which allows some simplifications
throughout the code base.

BUG=v8:3768
LOG=N
R=adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1154103005

Cr-Commit-Position: refs/heads/master@{#28802}

Embed constant pools within their corresponding Code
objects.

This removes support for out-of-line constant pools in favor
of the new approach -- the main advantage being that it
eliminates the need to allocate and manage separate constant
pool array objects.

Currently supported on PPC and ARM.  Enabled by default on
PPC only.

This yields a 6% improvment in Octane on PPC64.

R=bmeurer@chromium.org, rmcilroy@chromium.org, michael_dawson@ca.ibm.com
BUG=chromium:478811
LOG=Y

Review URL: https://codereview.chromium.org/1162993006

Cr-Commit-Position: refs/heads/master@{#28801}

Review URL: https://codereview.chromium.org/1152993005

Cr-Commit-Position: refs/heads/master@{#28800}

Rolling v8/tools/clang to b7e158c9336030c1527dfbce92656a2d7b8cfb60

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1150313007

Cr-Commit-Position: refs/heads/master@{#28799}

BUG=

Review URL: https://codereview.chromium.org/1167613004

Cr-Commit-Position: refs/heads/master@{#28798}

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1153373003

Cr-Commit-Position: refs/heads/master@{#28797}

This is behind the flag "--harmony-atomics", and it only works on
SharedArrayBuffers. This implementation only includes the runtime functions.
The TurboFan implementation will be next.

The draft spec for Atomics can be found here:
https://docs.google.com/document/d/1NDGA_gZJ7M7w1Bh8S0AoDyEqwDdRh4uSoTPSNn77PFk

BUG=
LOG=n

Review URL: https://codereview.chromium.org/1162503002

Cr-Commit-Position: refs/heads/master@{#28796}

Port 4b8051a0

Original commit message:
This splits the SuperReference AST node into SuperPropertyReference and
SuperCallReference. The super call reference node consists of three
unresolved vars to this, new.target and this_function. These gets
declared when the right function is entered and if it is in use. The
variables gets assigned in FullCodeGenerator::Generate.

This is a revert of the revert 88b1c917

BUG=v8:3768
LOG=N

Review URL: https://codereview.chromium.org/1160973008

Cr-Commit-Position: refs/heads/master@{#28795}

Port e4782a9b

Original commit message:
Previously the %_DateField intrinsic would also check the object and
throw an exception if you happen to pass something that is not a valid
JSDate, which (a) violates our policy for instrinsics and (b) is hard to
optimize in TurboFan (even Crankshaft has a hard time, but there we will
never inline the relevant builtins, so it doesn't show up). The throwing
part is now a separate intrinsics %_ThrowIfNotADate that throws an
exception in full codegen and deoptimizes in Crankshaft, which means the
code for the current use cases is roughly the same (modulo some register
renamings/gap moves).

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1170463002

Cr-Commit-Position: refs/heads/master@{#28794}

This will significantly simplify the serialization code, as well
as speeding it up (by triggering only a single allocation instead of O(size)
allocations).

BUG=chromium:478263
LOG=y

Review URL: https://codereview.chromium.org/1157843006

Cr-Commit-Position: refs/heads/master@{#28793}

Review URL: https://codereview.chromium.org/1159553011

Cr-Commit-Position: refs/heads/master@{#28792}

Port 4b8051a0

Original commit message:
This splits the SuperReference AST node into SuperPropertyReference and
SuperCallReference. The super call reference node consists of three
unresolved vars to this, new.target and this_function. These gets
declared when the right function is entered and if it is in use. The
variables gets assigned in FullCodeGenerator::Generate.

This is a revert of the revert 88b1c917

R=arv@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1146403010

Cr-Commit-Position: refs/heads/master@{#28791}

BUG=chromium:493284
LOG=N

Review URL: https://codereview.chromium.org/1147343004

Cr-Commit-Position: refs/heads/master@{#28790}

BUG=v8:4131
LOG=n

Review URL: https://codereview.chromium.org/1155493007

Cr-Commit-Position: refs/heads/master@{#28789}

This fixes a corner-case where arrow functions that require a context
allocate none, because there are no additional slots allocated. Note
that this didn't happen with true function scopes because they always
had at least the receiver slot.

The outcome was a context chain that no longer was in sync with the
scope chain, hence context slot loads were bogus. This is observable
using the DYNAMIC_LOCAL optimization in all compilers.

R=rossberg@chromium.org,wingo@igalia.com
TEST=mjsunit/harmony/regress/regress-4160
BUG=v8:4160
LOG=N

Review URL: https://codereview.chromium.org/1146063006

Cr-Commit-Position: refs/heads/master@{#28788}

The IC for modulus is usually way faster than converting the inputs to
numbers and doing a Float64Mod on them.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1170433002

Cr-Commit-Position: refs/heads/master@{#28787}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1150853009

Cr-Commit-Position: refs/heads/master@{#28786}

Constants are taken from chromium/src/google_breakpad/common/minidump_cpu_arm64.h

BUG=

Review URL: https://codereview.chromium.org/1149293005

Cr-Commit-Position: refs/heads/master@{#28785}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1155723005

Cr-Commit-Position: refs/heads/master@{#28784}

Also turn on the macro to disable to-be-deprecated APIs for core

BUG=v8:4134
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1162363005

Cr-Commit-Position: refs/heads/master@{#28783}

Previously the %_DateField intrinsic would also check the object and
throw an exception if you happen to pass something that is not a valid
JSDate, which (a) violates our policy for instrinsics and (b) is hard to
optimize in TurboFan (even Crankshaft has a hard time, but there we will
never inline the relevant builtins, so it doesn't show up). The throwing
part is now a separate intrinsics %_ThrowIfNotADate that throws an
exception in full codegen and deoptimizes in Crankshaft, which means the
code for the current use cases is roughly the same (modulo some register
renamings/gap moves).

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1167813003

Cr-Commit-Position: refs/heads/master@{#28782}

BUG=

Review URL: https://codereview.chromium.org/1151993005

Cr-Commit-Position: refs/heads/master@{#28781}

This means something like new Float32Array([23, 42]) will be allocated on heap.

BUG=v8:3996
R=bmeurer@chromium.org,mstarzinger@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1144393003

Cr-Commit-Position: refs/heads/master@{#28780}

fix two additional cases in heap.cc where the AIX
compiler is now reporting that a variable may be
uninitialized.

R=svenpanne@chromium.org, mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1157053007

Cr-Commit-Position: refs/heads/master@{#28779}

Both PrepareForScavenge and ResetAllocationInfo clear semi-space mark bits before Scavenge. Doing this once is good enough.

BUG=

Review URL: https://codereview.chromium.org/1158623003

Cr-Commit-Position: refs/heads/master@{#28778}

Revert of Implement %TypedArray%.prototype.{reduce,reduceRight} (patchset #3 id:40001 of https://codereview.chromium.org/1154423014/)

Reason for revert:
Breaks Win32 mjsunit/harmony/typedarray-reduce, see http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/7121/steps/Check/logs/typedarray-reduce for details.

Original issue's description:
> Implement %TypedArray%.prototype.{reduce,reduceRight}
>
> This patch implements the last two methods on TypedArrays. These
> were previously committed and led to a test failure.
>
> BUG=v8:3578
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/95d779ecc9816ac20c1565bebeeac6a1ef29f1c7
> Cr-Commit-Position: refs/heads/master@{#28773}

TBR=adamk@chromium.org,dehrenberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3578

Review URL: https://codereview.chromium.org/1162043008

Cr-Commit-Position: refs/heads/master@{#28777}

In typed lowering we can use the ReferenceEqual simplified operator
instead of ObjectIsSmi to check for context extensions. This generates
the desired code.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1163963003

Cr-Commit-Position: refs/heads/master@{#28776}