BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1196543003

Cr-Commit-Position: refs/heads/master@{#29139}

BUG=chromium:502176
LOG=n

Review URL: https://codereview.chromium.org/1193843002

Cr-Commit-Position: refs/heads/master@{#29138}

R=machenbach@chromium.org
BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1186393007

Cr-Commit-Position: refs/heads/master@{#29137}

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1189183002

Cr-Commit-Position: refs/heads/master@{#29136}

R=mstarzinger@chromium.org
BUG=chromium:500980
LOG=N

Review URL: https://codereview.chromium.org/1191263002

Cr-Commit-Position: refs/heads/master@{#29135}

Not doing so could result in this scenario:
- We ensure that the string table is large enough. It is.
- We compile code stubs, which triggers a GC.
- The GC clears string table entries.
- This increases the number of deleted entries in the table.
- When the deserializer hooks up internalized strings into the
  table, we ensure that the table is large enough every time.
- Due to changed number of deleted entries, the heuristic
  decides to expand the string table.
- Allocation during deserialization causes assertion to fail.

BUG=chromium:502085
LOG=N

Review URL: https://codereview.chromium.org/1197633002

Cr-Commit-Position: refs/heads/master@{#29134}

port 41405c04 (r29122).

   fix spelling error in r29122.

BUG=

Review URL: https://codereview.chromium.org/1197593002

Cr-Commit-Position: refs/heads/master@{#29133}

We block constant pool up to the call stub instruction, but the check for code size
includes the next instruction after the call instruction. That instruction can
emit constant pool.

BUG=chromium:500831
LOG=NO
TEST=mjsunit/regress/regress-500831

Review URL: https://codereview.chromium.org/1189123003

Cr-Commit-Position: refs/heads/master@{#29132}

Rolling v8/build/gyp to 5122240c5e5c4d8da12c543d82b03d6089eb77c5

Rolling v8/third_party/icu to 00af1a4e512477e48ba3d5efc97adbc95462685e

Rolling v8/tools/clang to d2b4eddd701ff0265124147bcb0a65f32273f06b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1192743002

Cr-Commit-Position: refs/heads/master@{#29131}

Revert of Add d8 API for spawning function on a new thread. (patchset #6 id:100001 of https://codereview.chromium.org/1185643004/)

Reason for revert:
Fails on V8 Win32 - nosnap - shared (http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/7427)

Fails on V8 Arm - debug builder (http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/4361)

Fails on V8 Linux - shared (http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4430)

Original issue's description:
> Add d8 API for spawning function on a new thread.
>
> This API closely matches the Worker API. The differences:
>
> 1) The argument to the Worker constructor is a function to run, not a script.
> 2) Receiving a message from a worker is a synchronous API (as there is no event
> loop).
>
> The serialization done here is not robust as the real DOM implementation. For
> example, recursive data structures or otherwise duplicated objects are not
> allowed.
>
> BUG=none
> R=jochen@chromium.org
> LOG=n
>
> Committed: https://crrev.com/3d98b956b56fa283b40913788ff760022d478812
> Cr-Commit-Position: refs/heads/master@{#29126}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1192193002

Cr-Commit-Position: refs/heads/master@{#29130}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180753005

Cr-Commit-Position: refs/heads/master@{#29129}

TEST=cctest/test-simplified-lowering/RunAccessTests_float64
BUG=

Review URL: https://codereview.chromium.org/1182713004

Cr-Commit-Position: refs/heads/master@{#29128}

The ordering of the "IsArray()" check for IsConcatSpreadable() was incorrect previously --- IsArray() is only used if Get(O, @@isConcatSpreadable) is undefined. Without this fix, it's not possible for Array subclasses to opt out of spreading

22.1.3.1.1 http://www.ecma-international.org/ecma-262/6.0/#sec-isconcatspreadable

BUG=v8:3764
LOG=N
R=arv@chromium.org, dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1192153002

Cr-Commit-Position: refs/heads/master@{#29127}

This API closely matches the Worker API. The differences:

1) The argument to the Worker constructor is a function to run, not a script.
2) Receiving a message from a worker is a synchronous API (as there is no event
loop).

The serialization done here is not robust as the real DOM implementation. For
example, recursive data structures or otherwise duplicated objects are not
allowed.

BUG=none
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1185643004

Cr-Commit-Position: refs/heads/master@{#29126}

Reason for revert:
[Sheriff] Breaks layout tests. Please submit a needsmanualrebaseline change on the blink side for the expectations if intended.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/545

Original issue's description:
> Ship arrow functions
>
> R=rossberg@chromium.org
> LOG=Y
> BUG=v8:2700
>
> Committed: https://crrev.com/541b6c39e0ecae1c070f51fae8e9e3dab18d278c
> Cr-Commit-Position: refs/heads/master@{#29119}

TBR=rossberg@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2700

Review URL: https://codereview.chromium.org/1182053013

Cr-Commit-Position: refs/heads/master@{#29125}

Revert of [es6] ship Object.assign (patchset #2 id:20001 of https://codereview.chromium.org/1191003003/)

Reason for revert:
Seems to break asan somehow

Original issue's description:
> [es6] ship Object.assign
>
> BUG=v8:4007
> LOG=N
> R=rossberg@chromium.org, arv@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/12e194860a56d47a10d89ae34761a4af6b6166bb
> Cr-Commit-Position: refs/heads/master@{#29118}

TBR=arv@chromium.org,dslomov@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4007

Review URL: https://codereview.chromium.org/1191593005

Cr-Commit-Position: refs/heads/master@{#29124}

Revert of Re-land new insertion write barrier. (patchset #3 id:40001 of https://codereview.chromium.org/1153233003/)

Reason for revert:
Deoptimizer crashes.

Original issue's description:
> Re-land new insertion write barrier.
>
> BUG=
>
> Committed: https://crrev.com/72f850458cb530d871cf3fb6442660555dc51bc2
> Cr-Commit-Position: refs/heads/master@{#29052}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176243015

Cr-Commit-Position: refs/heads/master@{#29123}

Revert of Revert of [strong] Implement strong mode restrictions on property access (patchset #1 id:1 of https://codereview.chromium.org/1189153002/)

Reason for revert:
Issue was ultimately caused/fixed by https://codereview.chromium.org/1194673002/

Original issue's description:
> Revert of [strong] Implement strong mode restrictions on property access (patchset #23 id:460001 of https://codereview.chromium.org/1168093002/)
>
> Reason for revert:
> Speculative revert, maybe breaks GC-stress
>
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/808
>
> Original issue's description:
> > [strong] Implement strong mode restrictions on property access
> >
> > Implements the strong mode proposal's restrictions on property access.
> >
> > To be fully explored in a followup: proxies, interceptors, access checks, load from super
> >
> > BUG=v8:3956
> > LOG=N
> >
> > Committed: https://crrev.com/85dbfb9a389e7b21bd2a63862202ee97fc5d7982
> > Cr-Commit-Position: refs/heads/master@{#29109}
>
> TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3956
>
> Committed: https://crrev.com/407657b706711fd5f8d417841e24b284886f3776
> Cr-Commit-Position: refs/heads/master@{#29115}

TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1185343005

Cr-Commit-Position: refs/heads/master@{#29122}

Revert of Replace ad-hoc weakness in transition array with WeakCell. (patchset #5 id:80001 of https://codereview.chromium.org/1157943003/)

Reason for revert:
Breaks descriptor array clearing.

Original issue's description:
> Replace ad-hoc weakness in transition array with WeakCell.
>
> BUG=
>
> Committed: https://crrev.com/885455e99de817f86a0b5df2dc0d932cfc179749
> Cr-Commit-Position: refs/heads/master@{#29083}

TBR=jkummerow@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1194673002

Cr-Commit-Position: refs/heads/master@{#29121}

RegExpExecStub pushes callee-saved registers without setting up a frame. This confuses the stack iterator.

Other architectures do not save these registers.

BUG=chromium:487981
LOG=NO
TEST=mjsunit/regress/regress-487981

Review URL: https://codereview.chromium.org/1183593005

Cr-Commit-Position: refs/heads/master@{#29120}

R=rossberg@chromium.org
LOG=Y
BUG=v8:2700

Review URL: https://codereview.chromium.org/1187173004

Cr-Commit-Position: refs/heads/master@{#29119}

BUG=v8:4007
LOG=N
R=rossberg@chromium.org, arv@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1191003003

Cr-Commit-Position: refs/heads/master@{#29118}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1189943005

Cr-Commit-Position: refs/heads/master@{#29117}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1191813003

Cr-Commit-Position: refs/heads/master@{#29116}

Revert of [strong] Implement strong mode restrictions on property access (patchset #23 id:460001 of https://codereview.chromium.org/1168093002/)

Reason for revert:
Speculative revert, maybe breaks GC-stress

http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/808

Original issue's description:
> [strong] Implement strong mode restrictions on property access
>
> Implements the strong mode proposal's restrictions on property access.
>
> To be fully explored in a followup: proxies, interceptors, access checks, load from super
>
> BUG=v8:3956
> LOG=N
>
> Committed: https://crrev.com/85dbfb9a389e7b21bd2a63862202ee97fc5d7982
> Cr-Commit-Position: refs/heads/master@{#29109}

TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1189153002

Cr-Commit-Position: refs/heads/master@{#29115}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1190143002

Cr-Commit-Position: refs/heads/master@{#29114}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1188073003

Cr-Commit-Position: refs/heads/master@{#29113}

BUG=chromium:493043
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1196453002

Cr-Commit-Position: refs/heads/master@{#29112}

This is a first step towards disentangling the backend code. In the future we should just use ElementsAccessors.
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177043012

Cr-Commit-Position: refs/heads/master@{#29111}

R=yangguo@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1179413006

Cr-Commit-Position: refs/heads/master@{#29110}

Implements the strong mode proposal's restrictions on property access.

To be fully explored in a followup: proxies, interceptors, access checks, load from super

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1168093002

Cr-Commit-Position: refs/heads/master@{#29109}

Currently, the desugaring of for loops of the form for
(let/const ...; bla; bla) causes them to always have a
completion value of 1, regardless of whether the loop body
is executed or not. This CL fixes this, realigning
initializer blocks as a more general purpose way to avoid
the completion value rewriter (since that's all they really
do anyway).

BUG=

Review URL: https://codereview.chromium.org/1177053006

Cr-Commit-Position: refs/heads/master@{#29108}

Reland [turbofan] Disable select matching due to bug manifesting on arm. (patchset #2 id:40001 of https://codereview.chromium.org/1176403005/)

Reason for revert:
This causes timeouts in Massive on chromebooks.

Original issue's description:
> Revert of [turbofan] Disable select matching due to bug manifesting on arm. (patchset #1 id:1 of https://codereview.chromium.org/1077613002/)
>
> Reason for revert:
> [Sheriff] Checking if this still fails and if yes persists info about failures.
>
> Original issue's description:
> > [turbofan] Disable select matching due to bug manifesting on arm.
> >
> > R=machenbach@chromium.org
> > BUG=
> >
> > Committed: https://crrev.com/6e5d805718195c4b5ac64cd540379cecf10b8f5c
> > Cr-Commit-Position: refs/heads/master@{#27702}
>
> TBR=bmeurer@chromium.org
>
> Committed: https://crrev.com/7c36a7d91d8706b29df07013085fbe3c8e93b0ed
> Cr-Commit-Position: refs/heads/master@{#29103}

TBR=titzer@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1195563003

Cr-Commit-Position: refs/heads/master@{#29107}

Dampen the old generation allocation limit only after the initial old generation size was configured.

Otherwise, dampening interferes with initial size configuration and causes GC too early.

BUG=501703
LOG=NO

Review URL: https://codereview.chromium.org/1183633005

Cr-Commit-Position: refs/heads/master@{#29106}

This turns the CommonOperatorReducer into an AdvancedReducer and makes
it independent of JSGraph (which was used only because it was convienent),
and let's the CommonOperatorReducer run together with the ControlReducer.

The ControlReducer is still not able to run together with other reducers,
but we're getting closer. The plan is to split the ControlReducer into
two parts: The dead code elimination part and the common operator
reduction part. This separation will help to avoid tricky bugs in the
future and should make testing a *lot* easier.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1192063002

Cr-Commit-Position: refs/heads/master@{#29105}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186033006

Cr-Commit-Position: refs/heads/master@{#29104}

Revert of [turbofan] Disable select matching due to bug manifesting on arm. (patchset #1 id:1 of https://codereview.chromium.org/1077613002/)

Reason for revert:
[Sheriff] Checking if this still fails and if yes persists info about failures.

Original issue's description:
> [turbofan] Disable select matching due to bug manifesting on arm.
>
> R=machenbach@chromium.org
> BUG=
>
> Committed: https://crrev.com/6e5d805718195c4b5ac64cd540379cecf10b8f5c
> Cr-Commit-Position: refs/heads/master@{#27702}

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1176403005

Cr-Commit-Position: refs/heads/master@{#29103}

We never hit the phi case for DecideCondition in practice, since a more
general optimization is already performed by typing and constant
propagation.

R=jarin@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186973005

Cr-Commit-Position: refs/heads/master@{#29102}

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1185623003

Cr-Commit-Position: refs/heads/master@{#29101}

On MIPS32 we can't read a 8 bytes long data from a not 8 bytes aligned memory address.

BUG=
TEST=mjsunit/debug-backtrace

Review URL: https://codereview.chromium.org/1193433002

Cr-Commit-Position: refs/heads/master@{#29100}