Also changed the way that transitioning stores are represented in
a PropertyAccessInfo: There's no dedicated kind, but DataFields
have an optional transition map.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1416973014

Cr-Commit-Position: refs/heads/master@{#31692}

BUG=chrome-os-partner:36669
R=jochen@chromium.org
LOG=N
Signed-off-by: Milton Chiang <milton.chiange@mediatek.com>

Review URL: https://codereview.chromium.org/1223613003

Cr-Commit-Position: refs/heads/master@{#31691}

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1427003006

Cr-Commit-Position: refs/heads/master@{#31690}

If the CallIC collected a known target function for a callsite, add
a runtime check to ensure that the feedback remains the same and
specialize the JSCallFunction node to the known target function so that
inlining and typed lowering can pick up the feedback.

R=mstarzinger@chromium.org
BUG=v8:4470, v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1428923002

Cr-Commit-Position: refs/heads/master@{#31689}

Removes deprecated functions from the following files:
 test/cctest/interpreter/test-bytecode-generator.cc
 test/cctest/interpreter/test-interpreter.cc

BUG=v8:4134
LOG=N

Review URL: https://codereview.chromium.org/1421223005

Cr-Commit-Position: refs/heads/master@{#31688}

Adds support for switch statments to the interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1415093006

Cr-Commit-Position: refs/heads/master@{#31687}

R=yangguo@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1427583008

Cr-Commit-Position: refs/heads/master@{#31686}

Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1415883007

Cr-Commit-Position: refs/heads/master@{#31685}

Revert of [es6] Better support for built-ins subclassing. (patchset #8 id:200001 of https://codereview.chromium.org/1427483002/ )

Reason for revert:
Breaks test on win32 nosnap.http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/9680

Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1416943005

Cr-Commit-Position: refs/heads/master@{#31684}

Adds wide bytecode varients, which take 16-bit feedback slot and constant
pool entry indexes for the following bytecodes:
  - LoadICSloppyWide
  - LoadICStrictWide
  - KeyedLoadICSloppyWide
  - KeyedLoadICStrictWide
  - StoreICSloppyWide
  - StoreICStrictWide
  - KeyedStoreICSloppyWide
  - KeyedStoreICStrictWide
  - LdaGlobalSloppyWide
  - LdaGlobalStrictWide
  - StaGlobalSloppyWide
  - StaGlobalStrictWide
  - LdaConstantWide

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1413863010

Cr-Commit-Position: refs/heads/master@{#31683}

This is currently hardcoded in the infra-side test runner
setup, but will be removed there, so that swarming triggers
don't need a custom environment.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1411733008

Cr-Commit-Position: refs/heads/master@{#31682}

This moves the cctest file for the interpreter to live in the same
namespace as the components it is testing. Hence we can avoid the
forbidden using directives pulling in entire namespaces.

From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1410993009

Cr-Commit-Position: refs/heads/master@{#31681}

Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
This CL also fixes subclassing from String.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1427483002

Cr-Commit-Position: refs/heads/master@{#31680}

Revert of Remove RegExp.multiline accessors. (patchset #3 id:40001 of https://codereview.chromium.org/1410993008/ )

Reason for revert:
[Sheriff] Causes layout test failures.

Original issue's description:
> Remove RegExp.multiline accessors.
>
> This is non-standard and not even documented on MDN.
>
> On Firefox, setting RegExp.multiline to true adds the multiline flag to all
> newly created RegExp objects (both from constructor and from literal).
>
> In V8 this has no effect.
>
> Source archaelogy shows that this is from the initial commit.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/e8f752ce0c2a488e88cd87fe75f3907b4303d0a0
> Cr-Commit-Position: refs/heads/master@{#31673}

TBR=bmeurer@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1431433004

Cr-Commit-Position: refs/heads/master@{#31679}

This is in preparation of implementing Reflect.set.

Besides making SetSuperProperty and others return Maybe<bool>, this CL
also fixes some parts of my previous refactoring of SetProperty and
others: It doesn't make sense to take both a language_mode and a
should_throw argument.  A strict language_mode should imply
THROW_ON_ERROR.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1431443003

Cr-Commit-Position: refs/heads/master@{#31678}

BUG=chromium:549162
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1424293002

Cr-Commit-Position: refs/heads/master@{#31677}

This adds optimized lowering for JSConvertReceiver (in the general case)
and JSToObject in typed lowering. It also uses JSConvertReceiver for
direct calls in typed lowering.

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1431543002

Cr-Commit-Position: refs/heads/master@{#31676}

Adds new Guard[Type] common operator, which takes value and control
inputs and records a guaranty that a certain value has a certain type
in that control path.  This is some kind of ad-hoc SSI similar to what
we have to do in Crankshaft in some places.

Also introduces an ObjectIsNumber simplified operator, which checks
whether a certain value is a number (either a Smi or a HeapNumber).

This doesn't yet support transitioning stores to double fields, which
require support for allocating mutable heap numbers.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1420283009

Cr-Commit-Position: refs/heads/master@{#31675}

Proxies are not properly supported yet.

R=rossberg, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1408163005

Cr-Commit-Position: refs/heads/master@{#31674}

This is non-standard and not even documented on MDN.

On Firefox, setting RegExp.multiline to true adds the multiline flag to all
newly created RegExp objects (both from constructor and from literal).

In V8 this has no effect.

Source archaelogy shows that this is from the initial commit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410993008

Cr-Commit-Position: refs/heads/master@{#31673}

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1425143002

Cr-Commit-Position: refs/heads/master@{#31672}

This moves all cctest files for the compiler to live in the same
namespace as the components they are testing. Hence we can avoid the
forbidden using directives pulling in entire namespaces.

From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1424943004

Cr-Commit-Position: refs/heads/master@{#31671}

If you are not logged in with your Google account you are
faced with a blank screen. In order to make it more
clear for the Chromium sheriffs on how to close the
auto-roller I want to add this information.

R=machenbach@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1392823004

Cr-Commit-Position: refs/heads/master@{#31670}

BUG=

Review URL: https://codereview.chromium.org/1418213007

Cr-Commit-Position: refs/heads/master@{#31669}

In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1425883004

Cr-Commit-Position: refs/heads/master@{#31668}

Rolling v8/buildtools to acafdaa4e81adae617177d57e3c1261cc3565469

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1420973008

Cr-Commit-Position: refs/heads/master@{#31667}

We have plans to create more ICs, and we are out of bits to represent the Kind
in the flags field of the code object. The InlineCacheState can lose a bit
because it no longer needs the DEFAULT state. That state existed as a way to
detect errors where code incorrectly looked at a vector IC stub's
InlineCacheState instead of correctly determining said state from a glance at
the vector. This really isn't a danger anymore.

So, with the horse trading, we could now represent up to 32 code kinds.

BUG=

Review URL: https://codereview.chromium.org/1427803003

Cr-Commit-Position: refs/heads/master@{#31666}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1423673003

Cr-Commit-Position: refs/heads/master@{#31665}

This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}

Most use sites of Call::GetCallType already distinguish the property
call case (i.e. formerly known as Call::PROPERTY_CALL) further. This
introduces this distinction to simplify use sites.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1414413004

Cr-Commit-Position: refs/heads/master@{#31663}

we may introduce moves that are redundant in the context of
moves on subsequent instructions. Currently, we only detect such
redundancies by allowing moves to skip over Nop instructions (true
nops, with no input/output). We can also skip over other cases, for
example over constant definitions (nop with an output), since whatever
moves happen above it do not influence the instruction's outcome.

We may be able to handle other cases, too - in subsequent CLs.

BUG=

Review URL: https://codereview.chromium.org/1422333003

Cr-Commit-Position: refs/heads/master@{#31662}

Proxies are not properly supported yet.

R=rossberg,jkummerow@chromium.org
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1421033002

Cr-Commit-Position: refs/heads/master@{#31661}

This requires copying usage flags from the outer scope to the
arrow scope upon encountering the arrow token.

In order to properly pass-on the calls_eval bit, now record
that bit on script scopes just like everywhere else, and add
necessary code to scopes.cc to handle that change in behavior.

Also factored out scope flag propagation to its own method to
make the call site simple (though note that only the eval
bit makes any difference for arrows).

BUG=v8:4395
LOG=n

Review URL: https://codereview.chromium.org/1423613002

Cr-Commit-Position: refs/heads/master@{#31660}

The fix is to broaden the set of cases for when NeedsHomeObject()
returns true. Note that this is broader than it needs to be (since,
e.g., non-arrow function scopes inside a method can't reference
super). But we don't track the types of inner scopes at the moment,
so this is the best we can do.

R=rossberg@chromium.org
BUG=v8:4522
LOG=n

Review URL: https://codereview.chromium.org/1411093008

Cr-Commit-Position: refs/heads/master@{#31659}

Also deprecate hidden values

BUG=none
LOG=y
R=rossberg@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1428793002

Cr-Commit-Position: refs/heads/master@{#31658}

Reland of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1428783004/ )

Reason for revert:
Unnecessary revert.

Original issue's description:
> Revert of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1408183006/ )
>
> Reason for revert:
> crashes on webkit_unit_tests V8-Blink Linux 32
>
> Original issue's description:
> > [heap] Decrease incremental marking finalization retry limit.
> >
> > BUG=chromium:548562
> > LOG=n
> >
> > Committed: https://crrev.com/c689f5759b46506c38c84f404ebd8dc326dcb76f
> > Cr-Commit-Position: refs/heads/master@{#31647}
>
> TBR=ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:548562
>
> Committed: https://crrev.com/f555708c5ee583dafbc803b0917c9cd87f1c9ac3
> Cr-Commit-Position: refs/heads/master@{#31648}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1412683010

Cr-Commit-Position: refs/heads/master@{#31657}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1407213005

Cr-Commit-Position: refs/heads/master@{#31656}

for starting major GC in the memory reducer.

BUG=

Review URL: https://codereview.chromium.org/1414483004

Cr-Commit-Position: refs/heads/master@{#31655}

This adapts the general purpose inlining heuristic to not inline within
or across the boundary of asm.js code. Note that this only affects the
heuristics, from a functional point of view it is still supported.

R=bmeurer@chromium.org
BUG=chromium:549000
LOG=n

Review URL: https://codereview.chromium.org/1418823005

Cr-Commit-Position: refs/heads/master@{#31654}

R=jarin@chromium.org
TEST=unittests/JSTypedLoweringTest.JSCreateArguments

Review URL: https://codereview.chromium.org/1417983004

Cr-Commit-Position: refs/heads/master@{#31653}