The ES6 specification does not explicitly state the attributes for the
'next' and 'throw' property descriptors, so their values are defined by
Section 17 [1]:

> Every other data property described in clauses 18 through 26 and in
> Annex B.2 has the attributes
> { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
> unless otherwise specified.

[1]
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-ecmascript-standard-built-in-objects

BUG=v8:3986
LOG=N
R=wingo,arv

Review URL: https://codereview.chromium.org/1051363003

Cr-Commit-Position: refs/heads/master@{#27770}

Reason for revert:
Test failures in string-index and regress-1187524.

This reverts commit b45a664f.

BUG=

Review URL: https://codereview.chromium.org/1050943004

Cr-Commit-Position: refs/heads/master@{#27769}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1072343002

Cr-Commit-Position: refs/heads/master@{#27768}

BUG=v8:3502
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1072573002

Cr-Commit-Position: refs/heads/master@{#27767}

When debugging Handle leaks in io.js we found it very convenient to be
able to Seal some specific (root in our case) scope to prevent Handle
allocations in it, and easily find leakage.

R=yangguo
BUG=

Review URL: https://codereview.chromium.org/1079713002

Cr-Commit-Position: refs/heads/master@{#27766}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1078353002

Cr-Commit-Position: refs/heads/master@{#27765}

Fix c67cb287

Cannot access kStartIndex and kDirectCall parameters as ints on 64-bit BE platforms.

R=yangguo@chromium.org, mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1074203003

Cr-Commit-Position: refs/heads/master@{#27764}

Port 74c38122

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078253004

Cr-Commit-Position: refs/heads/master@{#27763}

Port 725cdc53

Original commit message:
This reduces the overhead of recursive calls when context specialization
is enabled. Based on this it might be possible to further reduce the
overhead by also specializing the call itself.

As a drive-by-fix, port the fast context materialization optimization to
arm and arm64, that was previously only supported on x64 and ia32.

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078183002

Cr-Commit-Position: refs/heads/master@{#27762}

Port 4e7163ce

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1076263002

Cr-Commit-Position: refs/heads/master@{#27761}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1065863003

Cr-Commit-Position: refs/heads/master@{#27760}

Few pieces leftover which are now effectively dead code and can be safely
deleted.

BUG=v8:3502
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1052963004

Cr-Commit-Position: refs/heads/master@{#27759}

BUG=v8:3018
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1079103005

Cr-Commit-Position: refs/heads/master@{#27758}

Port 35a67b74

Original commit message:
Thanks to some careful assumptions, we can examine the object found at
vector[slot] and trust it's a heap object where the second field is
either a map if it's a WeakCell, or definitely not a map if it's a
Symbol, String or FixedArray. Use this to save a memory read.

BUG=

Review URL: https://codereview.chromium.org/1053843003

Cr-Commit-Position: refs/heads/master@{#27757}

Implements the strong mode proposal's static restrictions on the use of the
identifier 'undefined', for arrow functions. Assumes these restrictions are
intended to be identical to the restrictions on the use of 'eval and 'arguments'
in strict mode. In addition, Location variables inconsistantly named (e.g.
dupe_error_loc vs dupe_loc) are now consistently named the shorter way.

Baseline: https://codereview.chromium.org/1070633002

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1060883004

Cr-Commit-Position: refs/heads/master@{#27756}

Revert of Make full GC reduce memory footprint an explicit event in the idle notification handler. (patchset #2 id:20001 of https://codereview.chromium.org/1072363002/)

Reason for revert:
[Sheriff] breaks nosnap with timeouts:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/2513
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6220

Original issue's description:
> Make full GC reduce memory footprint an explicit event in the idle notification handler.
>
> BUG=
>
> Committed: https://crrev.com/845705aa99b6bfa8d264cfda1c3b5f1229802ab5
> Cr-Commit-Position: refs/heads/master@{#27753}

TBR=ulan@chromium.org,rmcilroy@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1081443002

Cr-Commit-Position: refs/heads/master@{#27755}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1074143002

Cr-Commit-Position: refs/heads/master@{#27754}

BUG=

Review URL: https://codereview.chromium.org/1072363002

Cr-Commit-Position: refs/heads/master@{#27753}

R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1072333002

Cr-Commit-Position: refs/heads/master@{#27752}

This fixes the arm(64) and mips(64) write barriers

BUG=

Review URL: https://codereview.chromium.org/1073133002

Cr-Commit-Position: refs/heads/master@{#27751}

BUG=

Review URL: https://codereview.chromium.org/1074153002

Cr-Commit-Position: refs/heads/master@{#27750}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1074133002

Cr-Commit-Position: refs/heads/master@{#27749}

BUG=

Review URL: https://codereview.chromium.org/1075933003

Cr-Commit-Position: refs/heads/master@{#27748}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1078073002

Cr-Commit-Position: refs/heads/master@{#27747}

Review URL: https://codereview.chromium.org/1075773003

Cr-Commit-Position: refs/heads/master@{#27746}

Review URL: https://codereview.chromium.org/1005393004

Cr-Commit-Position: refs/heads/master@{#27745}

identifier. Delete unused (and now incorrect) function IsValidStrictVariable.

Implements the strong mode proposal's static restrictions on the use of the
identifier 'undefined'. Assumes these restrictions are intended to be identical
to the restrictions on the use of 'eval' and 'arguments' in strict mode. The
AllowEvalOrArgumentsAsIdentifier enum has been renamed to
AllowRestrictedIdentifiers as logic involving it is now also used for this case.

BUG=v8:3956

LOG=N

Review URL: https://codereview.chromium.org/1070633002

Cr-Commit-Position: refs/heads/master@{#27744}

TBR=yangguo@chromium.org
NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1080513002

Cr-Commit-Position: refs/heads/master@{#27743}

I don't have a repro, but it seems that when we are close to the stack limit,
CollectEvacuationCandidates' local variables can blow the limit. To avoid
this, instead of always allocating a 2000-pointer-sizes array on the stack,
use a std::vector (which stores its elements on the heap), and while we're
at it, only allocate as many elements as we actually need.

Review URL: https://codereview.chromium.org/1073123002

Cr-Commit-Position: refs/heads/master@{#27742}

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1071333004

Cr-Commit-Position: refs/heads/master@{#27741}

Port 74c38122

Patch from Paul Lind <paul.lind@imgtec.com>.

BUG=

Review URL: https://codereview.chromium.org/1075183002

Cr-Commit-Position: refs/heads/master@{#27740}

Currently we always generate a diamond in the graph builder for every
legacy const context slot, which we cannot get rid of until late control
reduction, even if we know after context specialization that the slot is
already initialized.

Now we generate a select instead, which the CommonOperatorReducer
happily removes during typed lowering. This greatly speeds up asm.js
code generated by Emscripten with the new POINTER_MASKING mode.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1072353002

Cr-Commit-Position: refs/heads/master@{#27739}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1075143002

Cr-Commit-Position: refs/heads/master@{#27738}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1074063004

Cr-Commit-Position: refs/heads/master@{#27737}

BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1075133002

Cr-Commit-Position: refs/heads/master@{#27736}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1073083002

Cr-Commit-Position: refs/heads/master@{#27735}

BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1078623004

Cr-Commit-Position: refs/heads/master@{#27734}

This makes sure Crankshaft respects interceptors in the global object
even when they shadow a constant global property.

R=verwaest@chromium.org
TEST=cctest/test-api-interceptors/PrePropertyHandler

Review URL: https://codereview.chromium.org/1070803002

Cr-Commit-Position: refs/heads/master@{#27733}

R=svenpanne@chromium.org
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1073983004

Cr-Commit-Position: refs/heads/master@{#27732}

Ideally we would not need the StoreWriteBarrier instructions at all,
but represent the RecordWrite functionality as machine subgraph, but
that'll take some time to get there. In the mean time we can have a
shorter instruction sequence on Intel platforms by recognizing immediate
indices here.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1075103002

Cr-Commit-Position: refs/heads/master@{#27731}