This addresses an issue where the at-start splitting used
in the splintering mechanism was in conflict with the mechanics
used in linear allocator, in particular in the initial split/spill of
ranges for memory operands. We are already doing a split-at-start in
Greedy, so this change centralizes that to the base RegisterAllocator.

Verified locally that v8:4508 is addressed by this. Also, this fixes
the failures that required the revert
5308a999. See trybots at
issue 1425533002.

R=bmeurer@chromium.org,jarin@chromium.org
BUG= v8:4508
LOG=n

Review URL: https://codereview.chromium.org/1426583002

Cr-Commit-Position: refs/heads/master@{#31544}

Revert of X87: disable the regress-undefined-nan test case for x87. (patchset #1 id:1 of https://codereview.chromium.org/1414733004/ )

Reason for revert:
because of merge mistake, "regress/" is missed when skipping one test case for X87.

 "regress/" will be added when relanding it.

Original issue's description:
> X87: disable the regress-undefined-nan test case for x87.
>
>   The reason is when native_context_specialization flag is ture, X87 turbofan
>   will hit the known issue that X87 will change a sNaN to qNaN by default. And
>   then it will fail when bit-comparing the source (sNaN) and the result (qNaN).
>
> BUG=
>
> Committed: https://crrev.com/b3c719ebbad6c87afefa33a7d0b3f412b2e304db
> Cr-Commit-Position: refs/heads/master@{#31530}

TBR=bmeurer@chromium.org,weiliang.lin@intel.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1417303005

Cr-Commit-Position: refs/heads/master@{#31543}

    port e678a0f9 (r31358)

    original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

BUG=

Review URL: https://codereview.chromium.org/1421803002

Cr-Commit-Position: refs/heads/master@{#31542}

    port 053e280c (r31319).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1420233002

Cr-Commit-Position: refs/heads/master@{#31541}

Cr-Commit-Position: refs/heads/master@{#31540}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413903003

Cr-Commit-Position: refs/heads/master@{#31539}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413013003

Cr-Commit-Position: refs/heads/master@{#31538}

For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}

Rolling v8/tools/clang to 66f5328417331216569e8beb244fd887f62e8997

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1403423006

Cr-Commit-Position: refs/heads/master@{#31536}

Revert of Reland "Use C++ implementation of Object.definePropert{y,ies}" (patchset #2 id:20001 of https://codereview.chromium.org/1413123004/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> Reland "Use C++ implementation of Object.definePropert{y,ies}"
>
> This reverts commit 581ead5c.
>
> Committed: https://crrev.com/034f4a6ae14cd5c29ceddbdb8f9af179803ca793
> Cr-Commit-Position: refs/heads/master@{#31473}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421123002

Cr-Commit-Position: refs/heads/master@{#31535}

Revert of Introduce LookupIterator::Restart() and use it (patchset #2 id:20001 of https://codereview.chromium.org/1416053007/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Needed so the reverts applies cleanly and seems to be related to the offending CL.

Original issue's description:
> Introduce LookupIterator::Restart() and use it
>
> Committed: https://crrev.com/5676415b4add059b78f98a9a762d00c8d721dbcd
> Cr-Commit-Position: refs/heads/master@{#31483}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418213003

Cr-Commit-Position: refs/heads/master@{#31534}

Revert of OrdinaryDefineOwnProperty: always reset the LookupIterator before storing. (patchset #1 id:1 of https://codereview.chromium.org/1415823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> OrdinaryDefineOwnProperty: always reset the LookupIterator before storing.
>
> Committed: https://crrev.com/7bc5ce16ee9244869384cdf17ea2feb0a9dde9bd
> Cr-Commit-Position: refs/heads/master@{#31511}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418303002

Cr-Commit-Position: refs/heads/master@{#31533}

Revert of GetOwnPropertyDescriptor: API-style accessors can throw, check for that. (patchset #1 id:1 of https://codereview.chromium.org/1412823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> GetOwnPropertyDescriptor: API-style accessors can throw, check for that.
>
> Committed: https://crrev.com/cbda86196b0b52694f50982ae3f1ac8e72056e6d
> Cr-Commit-Position: refs/heads/master@{#31522}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421483004

Cr-Commit-Position: refs/heads/master@{#31532}

Revert of [Turbofan] Fix perf regression (patchset #1 id:1 of https://codereview.chromium.org/1412123009/ )

Reason for revert:
[sheriff] breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/4998

Original issue's description:
> [Turbofan] Fix perf regression introduced by per-range change.
>
> When the range ends just at the gap of a non-deferred block, the last
> instruction the range covers is in the predecessor. If that predecessor is
> a deferred block, before this CL, we would splinter the remainder of the
> range all the way to the end. That leads to inefficient codegen, because
> we still want a split inside the deferred block.
>
> Also, opportunistically added a trace before we splinter, for better
> diagnostics.
>
> BUG= chromium:546416
> LOG=N
>
> Committed: https://crrev.com/32b6e085e74a8fcf94a01d20740fe4fdede07a86
> Cr-Commit-Position: refs/heads/master@{#31529}

TBR=bmeurer@chromium.org,jarin@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= chromium:546416

Review URL: https://codereview.chromium.org/1412893007

Cr-Commit-Position: refs/heads/master@{#31531}

  The reason is when native_context_specialization flag is ture, X87 turbofan
  will hit the known issue that X87 will change a sNaN to qNaN by default. And
  then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

BUG=

Review URL: https://codereview.chromium.org/1414733004

Cr-Commit-Position: refs/heads/master@{#31530}

When the range ends just at the gap of a non-deferred block, the last
instruction the range covers is in the predecessor. If that predecessor is
a deferred block, before this CL, we would splinter the remainder of the
range all the way to the end. That leads to inefficient codegen, because
we still want a split inside the deferred block.

Also, opportunistically added a trace before we splinter, for better
diagnostics.

BUG= chromium:546416
LOG=N

Review URL: https://codereview.chromium.org/1412123009

Cr-Commit-Position: refs/heads/master@{#31529}

Review URL: https://codereview.chromium.org/1413663007

Cr-Commit-Position: refs/heads/master@{#31528}

Setting the prototype to whatever it currently is must succeed even if
the object is not extensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1423603002

Cr-Commit-Position: refs/heads/master@{#31527}

Fix aborting compaction for pages by doing two separate passes, one that scans
all live objects, and one that later on sweeps the page.

Detailed description see bug report.

BUG=chromium:539356,chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1413763011

Cr-Commit-Position: refs/heads/master@{#31526}

This patch switches sloppy-mode code from legacy const semantics
to ES2015 semantics. It is unknown how much of the web will be
broken by this; likely the patch will have to be reverted before
a branch happens.

BUG=v8:3739
LOG=Y
R=rossberg,adamk

Review URL: https://codereview.chromium.org/1420223003

Cr-Commit-Position: refs/heads/master@{#31525}

We don't need to have an (untested) fallback for the case that a
prototype map is not stable when specializing a named property,
because prototype maps are always stable (which is now guarded
by a DCHECK in CompilationDependencies).  Less (dead) code is
better code.

R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417973006

Cr-Commit-Position: refs/heads/master@{#31524}

BUG=

Review URL: https://codereview.chromium.org/1420253002

Cr-Commit-Position: refs/heads/master@{#31523}

Review URL: https://codereview.chromium.org/1412823003

Cr-Commit-Position: refs/heads/master@{#31522}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1425433002

Cr-Commit-Position: refs/heads/master@{#31521}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1423753002

Cr-Commit-Position: refs/heads/master@{#31520}

BUG=none
LOG=y
R=verwaest@chromium.org,bmeurer@chromium.org,rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review URL: https://codereview.chromium.org/1423723002

Cr-Commit-Position: refs/heads/master@{#31519}

    port 7557dc5a (r31312).

    original commit message:
    This change add a new bytecode for operator new and implements it using
    the Construct() builtin.

BUG=

Review URL: https://codereview.chromium.org/1423733002

Cr-Commit-Position: refs/heads/master@{#31518}

R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1407233006

Cr-Commit-Position: refs/heads/master@{#31517}

    port b3334087 (r31313).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1412893006

Cr-Commit-Position: refs/heads/master@{#31516}

Review URL: https://codereview.chromium.org/1412123006

Cr-Commit-Position: refs/heads/master@{#31515}

Reland of [turbofan] Fix and enable property stores. (patchset #1 id:1 of https://codereview.chromium.org/1414743005/ )

Reason for revert:
It is fixed.

Original issue's description:
> Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )
>
> Reason for revert:
> [Sheriff] Breaks benchmarks:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164
>
> Original issue's description:
> > [turbofan] Fix and enable property stores.
> >
> > Fix lookup for storing to properties, and also make sure we don't embed
> > deprecated map (using Map::TryUpdate).
> >
> > R=jarin@chromium.org
> > BUG=v8:4470
> > LOG=n
> >
> > Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> > Cr-Commit-Position: refs/heads/master@{#31509}
>
> TBR=jarin@chromium.org,bmeurer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4470
>
> Committed: https://crrev.com/50e5a7275f2bc93a8ae731acda0f7ac6e5e97c3c
> Cr-Commit-Position: refs/heads/master@{#31513}

TBR=jarin@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1421573003

Cr-Commit-Position: refs/heads/master@{#31514}

Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164

Original issue's description:
> [turbofan] Fix and enable property stores.
>
> Fix lookup for storing to properties, and also make sure we don't embed
> deprecated map (using Map::TryUpdate).
>
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> Cr-Commit-Position: refs/heads/master@{#31509}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1414743005

Cr-Commit-Position: refs/heads/master@{#31513}

TBR=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1424533002 .

Cr-Commit-Position: refs/heads/master@{#31512}

Review URL: https://codereview.chromium.org/1415823003

Cr-Commit-Position: refs/heads/master@{#31511}

This removes the requirement for handles as arguments, but also removes
concurrency support, which is not being used at the moment.

Supporting concurrency could be done by introducing a sibling class to
IdentityMap that includes RelocationLock on method calls.

R=bmeurer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1419563004

Cr-Commit-Position: refs/heads/master@{#31510}

Fix lookup for storing to properties, and also make sure we don't embed
deprecated map (using Map::TryUpdate).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1424523002

Cr-Commit-Position: refs/heads/master@{#31509}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1409363003

Cr-Commit-Position: refs/heads/master@{#31508}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1415283003

Cr-Commit-Position: refs/heads/master@{#31507}

    port 24622f5f (r31257).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1415033004

Cr-Commit-Position: refs/heads/master@{#31506}

    port f2f46aff (r31242).

    original commit message:
    The lack of a vector slot for the keyed store operation in filling in
    non-constant array literal properties led to undesirable contortions in
    compilers downwind of full-codegen. The use of a single slot to initialize all
    the array elements is sufficient.

BUG=

Review URL: https://codereview.chromium.org/1422443004

Cr-Commit-Position: refs/heads/master@{#31505}