There's no reason to limit the CompareIC to (known) JSObject instances,
as all JSReceivers behave the same wrt. abstract and strict equality.
So remove this historical limitation and track JSReceivers instead.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1502963002

Cr-Commit-Position: refs/heads/master@{#32642}

  port 1e671030 (r32614)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1502053003

Cr-Commit-Position: refs/heads/master@{#32641}

There's no benefit in embedding the context as a constant for direct
calls. In fact it seems to be cheaper both size and execution wise to
just always load the context from the target.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1506763002

Cr-Commit-Position: refs/heads/master@{#32640}

The test expectations should fail consistently in both release and debug
builds. DCHECK is only meant for debug-only checks in production code.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1506753002

Cr-Commit-Position: refs/heads/master@{#32639}

X87: Revert of Provide call counts for constructor calls, surface them as a vector IC. (patchset #4 id:60001 of https://codereview.chromium.org/1476413003/ )

  port e89e08ca (r32599)

  original commit message:
  Reason for revert:
  Seems to be (mostly) responsible for the most recent Speedometer regression, not 100% sure. Let's see what the bots have to say.

  Original issue's description:
  > Provide call counts for constructor calls, surface them as a vector IC.
  >
  > CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that ther
  >
  > BUG=
  >
  > Committed: https://crrev.com/66d5a9df62da458a51e8c7ed1811dc9660f4f418
  > Cr-Commit-Position: refs/heads/master@{#32452}

  additional description:
  Revert "X87: Provide call counts for constructor calls, surface them as a vector IC." as r32599 does

  This reverts commit 54a9d349.

BUG=

Review URL: https://codereview.chromium.org/1506723002

Cr-Commit-Position: refs/heads/master@{#32638}

X87: Reland of [debugger] do not restart frames that reference new.target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1493863004/ )

  port 15cb3fde (r32587)

  original commit message:
  Reason for revert:
  Didn't help...

  Original issue's description:
  > Revert of [debugger] do not restart frames that reference new.target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1493363002/ )
  >
  > Reason for revert:
  > [Sheriff] Speculative revert for https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225
  >
  > Original issue's description:
  > > [debugger] do not restart frames that reference new.target for liveedit.
  > >
  > > R=mstarzinger@chromium.org
  > >
  > > Committed: https://crrev.com/6fca870240bdbb07a365189b5eb0c98fa65b3682
  > > Cr-Commit-Position: refs/heads/master@{#32572}
  >
  > TBR=mstarzinger@chromium.org,yangguo@chromium.org
  > NOPRESUBMIT=true
  > NOTREECHECKS=true
  > NOTRY=true
  >
  > Committed: https://crrev.com/1a61dab34b9849f3f70a42ce69317e22758c53a1
  > Cr-Commit-Position: refs/heads/master@{#32582}

BUG=

Review URL: https://codereview.chromium.org/1501323002

Cr-Commit-Position: refs/heads/master@{#32637}

  port eaa0e596 (r32550)

  original commit message:
  This drops the specific slot containing the new.target value from our
  construct stub frames. This side-channel has been deprecated and will
  no longer be accessed by any consumers.

BUG=

Review URL: https://codereview.chromium.org/1504703002

Cr-Commit-Position: refs/heads/master@{#32636}

  port 440a42b7 (r32548)

  original commit message:
  This passes the new.target value in a register instead of through a
  side-channel via the construct stub. Note that this marks the last
  consumer of said side-channel and the special slot in the construct
  stub frame can be removed as a follow-up.

BUG=

Review URL: https://codereview.chromium.org/1503923002

Cr-Commit-Position: refs/heads/master@{#32635}

  port 0e956833 (r32549)

  original commit message:
  Whenever the InstanceOfStub finds a proxy (either passed as object or
  somewhere on the prototype chain), it should bailout to the
  %HasInPrototypeChain runtime function, which will do the right thing
  (soonish).

BUG=

Review URL: https://codereview.chromium.org/1508553002

Cr-Commit-Position: refs/heads/master@{#32634}

  port 5d38d681 (r32547)

  original commit message:
  It didn't support subclassing case at all and in non-subclassing case the runtime
  allocation didn't do the slack tracking step.

BUG=

Review URL: https://codereview.chromium.org/1506713002

Cr-Commit-Position: refs/heads/master@{#32633}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1497233002

Cr-Commit-Position: refs/heads/master@{#32632}

Rolling v8/tools/clang to 5b7bd8a08ae5ee5262c38e01f5b703cc193074d4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1502873002

Cr-Commit-Position: refs/heads/master@{#32631}

BUG=

Review URL: https://codereview.chromium.org/1434263003

Cr-Commit-Position: refs/heads/master@{#32630}

Revert of Clean up promises and fix an edge case bug (patchset #4 id:60001 of https://codereview.chromium.org/1488783002/ )

Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3266

Please request rebase upstream first.

Original issue's description:
> Clean up promises and fix an edge case bug
>
> This patch builds on previous Promise spec compliance work by
> cleaning out some old code which existed to support
> Promise.prototype.chain, rephrasing some code to correspond more
> closely to the specification, and removing some incorrect brand
> checking. A test is added for a bug in an edge case which was fixed.
>
> R=rossberg
> BUG=v8:3641
> LOG=Y
>
> Committed: https://crrev.com/1deb89c8fd3cb69714ae0a24e3b5a4e78f6b73b4
> Cr-Commit-Position: refs/heads/master@{#32627}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3641

Review URL: https://codereview.chromium.org/1501763004

Cr-Commit-Position: refs/heads/master@{#32629}

Rolling v8/tools/clang to 6ecb01a508c93b383990381a30c06d3cbb175e8c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1501173002

Cr-Commit-Position: refs/heads/master@{#32628}

This patch builds on previous Promise spec compliance work by
cleaning out some old code which existed to support
Promise.prototype.chain, rephrasing some code to correspond more
closely to the specification, and removing some incorrect brand
checking. A test is added for a bug in an edge case which was fixed.

R=rossberg
BUG=v8:3641
LOG=Y

Review URL: https://codereview.chromium.org/1488783002

Cr-Commit-Position: refs/heads/master@{#32627}

R=cbruni@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1500993003

Cr-Commit-Position: refs/heads/master@{#32626}

Port 1e671030

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1502573002

Cr-Commit-Position: refs/heads/master@{#32625}

This reverts commit 55b41ff32ded37bb4730a6e13ff831c5def2841e.

Port e89e08ca

Reason for revert:
    Seems to be (mostly) responsible for the most recent Speedometer regression, not 100% sure.
    Let's see what the bots have to say.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1501763002

Cr-Commit-Position: refs/heads/master@{#32624}

Attempt #<really big number>

Parses, and lazily rewrites Destructuring Assignment expressions. The rewriting strategy involves inserting a placeholder RewritableAssignmentExpression into the AST, whose content expression can be completely rewritten at a later time.

Lazy rewriting ensures that errors do not occur due to eagerly rewriting nodes which form part of a binding pattern, thus breaking the meaning of the pattern --- or by eagerly rewriting ambiguous constructs that are not immediately known

BUG=v8:811
LOG=Y
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1309813007

Cr-Commit-Position: refs/heads/master@{#32623}

On some architectures the InvokeBuiltin sequence does not go through
InvokeFunctionCode, which initializes the new.target register. This
initializes the register explicitly on these architectures for now.

R=ishell@chromium.org
BUG=chromium:565046
LOG=n

Review URL: https://codereview.chromium.org/1499953002

Cr-Commit-Position: refs/heads/master@{#32622}

We should consider deprecating the message based API as well in the
future.

BUG=none
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1485333007

Cr-Commit-Position: refs/heads/master@{#32621}

Having beefed up GetKeys() to support everything, use it for everything now.

This fixes Object.getOwnPropertyNames and Object.getOwnPropertySymbols for
Proxies, and gets rid of a bunch of code duplication.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1498593006

Cr-Commit-Position: refs/heads/master@{#32620}

Fixing warnings which cause compilation to fail when compiling
using CLANG for MIPS

BUG=

Review URL: https://codereview.chromium.org/1493793002

Cr-Commit-Position: refs/heads/master@{#32619}

BUG=none
R=ishell@chromium.org,hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1488053002

Cr-Commit-Position: refs/heads/master@{#32618}

Create a visitor for evacuating objects for young and old generation. This is
the first step of preparing a task to process, both,  newspace and oldspace
pages in parallel.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1499893002

Cr-Commit-Position: refs/heads/master@{#32617}

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1496503002

Cr-Commit-Position: refs/heads/master@{#32616}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1498983003

Cr-Commit-Position: refs/heads/master@{#32615}

R=verwaest@chromium.org

Committed: https://crrev.com/8f87ff5d62e996b07ffbde7e735daa603c1d7290
Cr-Commit-Position: refs/heads/master@{#32553}

Committed: https://crrev.com/00559c4584fe3a4c3c1a8d3a5b5af0611b19c40a
Cr-Commit-Position: refs/heads/master@{#32600}

Review URL: https://codereview.chromium.org/1491743005

Cr-Commit-Position: refs/heads/master@{#32614}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1499103002

Cr-Commit-Position: refs/heads/master@{#32613}

TEST=unittests/InstructionSelectorTest.Word(32|64)ShlWithWord(32|64)And
BUG=

Review URL: https://codereview.chromium.org/1496013003

Cr-Commit-Position: refs/heads/master@{#32612}

Cr-Commit-Position: refs/heads/master@{#32611}

Fix the missed store buffer entries for live objects on aborted pages. Marking
the page as scan_on_scavenge takes care of rebuilding the entries. Note that
this requires an additional case in the rebuilding logic as we cannot iterate an
aborted pages using the object layout, but rather have to use mark bits for
this.

BUG=chromium:524425, chromium:564498
LOG=N

Review URL: https://codereview.chromium.org/1497883003

Cr-Commit-Position: refs/heads/master@{#32610}

NOTRY=true

Review URL: https://codereview.chromium.org/1496303002

Cr-Commit-Position: refs/heads/master@{#32609}

For now, we revoke a proxy by setting its handler to null (as in the spec).

Change the "target" field from Object to JSReceiver as there's no point in
allowing more.

R=jkummerow@chromium.org, rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1496243003

Cr-Commit-Position: refs/heads/master@{#32608}

Revert of [debugger] do not predict step in target for liveedit. (patchset #2 id:20001 of https://codereview.chromium.org/1491743005/ )

Reason for revert:
[Sheriff] And it still breaks:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3239

Please run chromium trybots on relands of CLs that broke chromium bots.

Original issue's description:
> [debugger] do not predict step in target for liveedit.
>
> R=verwaest@chromium.org
>
> Committed: https://crrev.com/8f87ff5d62e996b07ffbde7e735daa603c1d7290
> Cr-Commit-Position: refs/heads/master@{#32553}
>
> Committed: https://crrev.com/00559c4584fe3a4c3c1a8d3a5b5af0611b19c40a
> Cr-Commit-Position: refs/heads/master@{#32600}

TBR=verwaest@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1498523008

Cr-Commit-Position: refs/heads/master@{#32607}

Revert of [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors. (patchset #2 id:20001 of https://codereview.chromium.org/1500543002/ )

Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
>
> The ArrayBuffer and SharedArrayBuffer constructors should raise an
> exception when called with no arguments or undefined length.  Also
> unified the ArrayBuffer and SharedArrayBuffer implementations as C++
> builtins, and removed some (now) obsolete runtime entries.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/3235ccbb7826ceec2188f6ebab98fc851b54f60e
> Cr-Commit-Position: refs/heads/master@{#32590}

TBR=yangguo@chromium.org,cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1501673002

Cr-Commit-Position: refs/heads/master@{#32606}

Revert of [es6] Match ArrayBuffer constructor behavior of Firefox. (patchset #1 id:1 of https://codereview.chromium.org/1497163002/ )

Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Match ArrayBuffer constructor behavior of Firefox.
>
> We choose to deliberately violate the ES2015 specification and implement
> the ArrayBuffer constructor in a way that matches Firefox and Safari
> instead.
>
> BUG=v8:4592
> LOG=n
>
> Committed: https://crrev.com/8aae841ce26f01f3535e54af3a58fb7c65833eb7
> Cr-Commit-Position: refs/heads/master@{#32597}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4592

Review URL: https://codereview.chromium.org/1496293002

Cr-Commit-Position: refs/heads/master@{#32605}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1496263002

Cr-Commit-Position: refs/heads/master@{#32604}

BUG=chromium:565306
LOG=NO

Review URL: https://codereview.chromium.org/1497743003

Cr-Commit-Position: refs/heads/master@{#32603}