Review URL: https://codereview.chromium.org/1401703003

Cr-Commit-Position: refs/heads/master@{#31304}

R=rossberg@chromium.org
BUG=chromium:539875
LOG=y

Review URL: https://codereview.chromium.org/1393373005

Cr-Commit-Position: refs/heads/master@{#31303}

The runtime flag in question makes no sense, because the feature cannot
be disabled without keeping the snapshot in sync. We should avoid having
the flag in our "mjsunit" test suite, so that CluserFuzz doesn't pick it
up. The test in question is already skipped, the change will not affect
test results on our waterfall.

R=mvstanton@chromium.org
TEST=mjsunit/call-counts
BUG=v8:4458
LOG=n

Review URL: https://codereview.chromium.org/1409533003

Cr-Commit-Position: refs/heads/master@{#31302}

Also update comments.

BUG=

Review URL: https://codereview.chromium.org/1392343004

Cr-Commit-Position: refs/heads/master@{#31301}

Revert of [turbofan] Splinter into one range. (patchset #2 id:80001 of https://codereview.chromium.org/1391023007/ )

Reason for revert:
Weird endless loop in TopLevelLiveRange::Merge() due to always splitting first and not making progress. See comments, unfortunately no useable repro.

Original issue's description:
> [turbofan] Splinter into one range.
>
> Before this CL, we created one live range per successive set of
> deferred blocks. For scenarios with many such blocks, this creates
> an upfront pressure for the register allocator to deal with many ranges.
> Linear sorts ranges, which is a super-linear operation.
>
> The change places all deferred intervals into one range, meaning that,
> at most, there will be twice as many live ranges as the original set. In
> pathological cases (benchmarks/Compile/slow_nbody1.js), this change
> halves the compilation time. We see some improvements elsewhere,
> notably SQLite at ~4-5%.
>
> We may be able to avoid the subsequent merge. Its cost is the
> additional ranges it may need to create. The sole reason for the merge
> phase is to provide an unchanged view of the world to the subsequent
> phases. With the at-most-one splinter model, we may be able to teach
> the other phases about splintering - should we find perf hindrances
> due to merging.
>
> Committed: https://crrev.com/efdcd20267870276c5824f1ccf4e171ac378f7ae
> Cr-Commit-Position: refs/heads/master@{#31224}

TBR=jarin@chromium.org,mtrofin@google.com,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1403163003

Cr-Commit-Position: refs/heads/master@{#31300}

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397443013

Cr-Commit-Position: refs/heads/master@{#31299}

Revert of [Interpreter] Support for operator new. (patchset #17 id:290001 of https://codereview.chromium.org/1402943002/ )

Reason for revert:
[Sheriff] Breaks arm64 debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/4595

Original issue's description:
> [Interpreter] Support for operator new.
>
> This change add a new bytecode for operator new and implements it using
> the Construct() builtin.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/8e4f9963d53913eab7fbd2f61a5733d8dc2169e7
> Cr-Commit-Position: refs/heads/master@{#31293}

TBR=rmcilroy@chromium.org,bmeurer@chromium.org,oth@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1402153004

Cr-Commit-Position: refs/heads/master@{#31298}

Review URL: https://codereview.chromium.org/1404983002

Cr-Commit-Position: refs/heads/master@{#31297}

R=rossberg@chromium.org
BUG=chromium:451967
LOG=N

Review URL: https://codereview.chromium.org/1404783002

Cr-Commit-Position: refs/heads/master@{#31296}

Revert of Make dates default to the local timezone if none specified  (https://codereview.chromium.org/1229903004/)

Even though the change is ES6 spec compliant, we decided to revert
to be consistent with other browsers and work on fixing the spec.

Original issue's description:
> Make dates default to the local timezone if none specified
>
> In ES5, dates were supposed to default to UTC if no timezone was specified. However, this changed in ES6, which specified that dates should be in the local timezone if no timezone was specified. This CL updates our behavior to match that part of the ES6 spec.

> BUG=chromium:391730, v8:4242
> LOG=Y

> Committed: https://crrev.com/f06754a8e1d305a43560705f6c167d85d40e602d
> Cr-Commit-Position: refs/heads/master@{#29854}

BUG=chromium:543320,chromium:539813
LOG=NO

Review URL: https://codereview.chromium.org/1403153003

Cr-Commit-Position: refs/heads/master@{#31295}

This is in preparation to enabling --turbo-inlining by default, fixing
various issues when general purpose inlining is running against our
entire test suite.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407533004

Cr-Commit-Position: refs/heads/master@{#31294}

This change add a new bytecode for operator new and implements it using
the Construct() builtin.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1402943002

Cr-Commit-Position: refs/heads/master@{#31293}

BUG=

Review URL: https://codereview.chromium.org/1405903003

Cr-Commit-Position: refs/heads/master@{#31292}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1407813004

Cr-Commit-Position: refs/heads/master@{#31291}

BUG=

Review URL: https://codereview.chromium.org/1403633004

Cr-Commit-Position: refs/heads/master@{#31290}

When the checker was added prohibiting lexical binding called let,
certain error propagation was not implemented properly. This patch
fixes that issue, which fixes error checking for cases such as
  let [let]

BUG=v8:4403
R=adamk
LOG=N

Review URL: https://codereview.chromium.org/1409613003

Cr-Commit-Position: refs/heads/master@{#31289}

Adds fake try/catch/finally support hidden behind the flag
--ignition-fake-try-catch.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1402093002

Cr-Commit-Position: refs/heads/master@{#31288}

This adds a bit of boilerplate to some AstVisitors (they now have to
declare their own zone_ member and zone() accessor), but makes it clearer
what DEFINE_AST_VISITOR_SUBCLASS_MEMBERS is for: stack limit checking.

Review URL: https://codereview.chromium.org/1394303008

Cr-Commit-Position: refs/heads/master@{#31287}

Also refactor the JSGlobalSpecialization somewhat to reduce the amount
of duplicated code somewhat.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1403223003

Cr-Commit-Position: refs/heads/master@{#31286}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1404943002

Cr-Commit-Position: refs/heads/master@{#31285}

This reverts commit dc0adc56.

NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1392853009

Cr-Commit-Position: refs/heads/master@{#31284}

Review URL: https://codereview.chromium.org/1398943003

Cr-Commit-Position: refs/heads/master@{#31283}

BUG=v8:4437
LOG=n

Review URL: https://codereview.chromium.org/1408693003

Cr-Commit-Position: refs/heads/master@{#31282}

Adds support for following operators
 -Logical and
 -Logical or
 -Comma

Adds the above bytecodes, support to BytecodeGenerator and BytecodeArrayBuilder
to enable it's use, it's implementation and tests.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1399773002

Cr-Commit-Position: refs/heads/master@{#31281}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1404553003

Cr-Commit-Position: refs/heads/master@{#31280}

R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1396323011

Cr-Commit-Position: refs/heads/master@{#31279}

An identifier may be parsed in an object literal like {let}, but
this was previously left out of lexical name checking. This patch
adds that check to prohibit code like
  let {let} = {let: 1}

BUG=v8:4403
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1401253003

Cr-Commit-Position: refs/heads/master@{#31278}

Revert of [x64] Use vcvtlsi2sd when AVX is enabled (patchset #1 id:1 of https://codereview.chromium.org/1404903004/ )

Reason for revert:
Caused a crash on Windows

Original issue's description:
> [x64] Use vcvtlsi2sd when AVX is enabled
>
> BUG=v8:4406
> LOG=N
>
> Committed: https://crrev.com/adcbe619a959fe1d8f21d06fbf5984868c4f6b9a
> Cr-Commit-Position: refs/heads/master@{#31276}

TBR=bmeurer@chromium.org,danno@chromium.org,yurys@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4406

Review URL: https://codereview.chromium.org/1396283004

Cr-Commit-Position: refs/heads/master@{#31277}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1404903004

Cr-Commit-Position: refs/heads/master@{#31276}

R=bmeurer@chromium.org
BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1391963005

Cr-Commit-Position: refs/heads/master@{#31275}

Rolling v8/buildtools to ef7f1f539cff0441c4401d8c052e54cfd01bff07

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1396783005

Cr-Commit-Position: refs/heads/master@{#31274}

Section 8.10.5 9a specifies that a property descriptor cannot both have
accessors and specify the writability of the property. The previous
error message was misleading because it referred to writable rather
than specifying the writability (which includes writable: false).

BUG=v8:2536
LOG=N

Review URL: https://codereview.chromium.org/1399693003

Cr-Commit-Position: refs/heads/master@{#31273}

https://codereview.chromium.org/1343113003 introduced a separate InternalPackedArray constructor to the extras utils object, distinct from the one used by natives. However, it omitted the code to set up the methods for that InternalPackedArray. This makes all the basic manipulation methods available.

BUG=v8:4276
LOG=Y
R=jochen@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1401243003

Cr-Commit-Position: refs/heads/master@{#31272}

Fixes corner case where arrow function ConciseBody expression does not
accept 'in' in productions.

BUG=v8:4472
LOG=N
R=wingo@igalia.com, adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1407633002

Cr-Commit-Position: refs/heads/master@{#31271}

When introducing experimental extras I forgot to update this check. That resulted in experimental extras running through the steps normally reserved for non-extra natives: macro and constant expansion, validation, and minification. This causes problems since per the linked bug minification is buggy.

R=yangguo@chromium.org, jochen@chromium.org
BUG=v8:4064
LOG=N

Review URL: https://codereview.chromium.org/1400253002

Cr-Commit-Position: refs/heads/master@{#31270}

For an edge case like the following in sloppy mode
  with ({}) function f() {}
a lexical scope needs to be created around the body in order
to hold the function declaration, so it can be hoisted according
to a loose interpretation of Annex B 3.3 (loose because ES2015
does not permit a function declaration as the body of a with
statement). This patch adds that scope.

BUG=chromium:542100
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1404803002

Cr-Commit-Position: refs/heads/master@{#31269}

This patch fixes an obscure edge case for functions defined as the
direct body of a for-of/for-in loop, such as the following:

 for (foo in []) function foo() { return foo; }

Here, the first occurrence of foo should point to the outer scope;
however, before this patch, it pointed to the inner foo in an
invalid way which caused an assertion about the scope chain to fail.
This patch fixes the scope chain by inserting an extra scope for
the body of the loop, not including the header.

BUG=chromium:542099
LOG=N
R=rossberg

Review URL: https://codereview.chromium.org/1396663004

Cr-Commit-Position: refs/heads/master@{#31268}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1402953004

Cr-Commit-Position: refs/heads/master@{#31267}

Revert of Add bailout for large objects when allocating arrays in optimized code. (patchset #1 id:1 of https://codereview.chromium.org/1408553002/ )

Reason for revert:
[Sheriff] Breaks deopt fuzzer:
http://build.chromium.org/p/client.v8/builders/V8%20Deopt%20Fuzzer/builds/5634

See comment in CL for repro.

Original issue's description:
> Add bailout for large objects when allocating arrays in optimized code.
>
> BUG=
>
> Committed: https://crrev.com/0c81c4e924d7bdb45fce98209c21985d754e047d
> Cr-Commit-Position: refs/heads/master@{#31259}

TBR=bmeurer@chromium.org,hpayer@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1409543002

Cr-Commit-Position: refs/heads/master@{#31266}

This CL re-purposes ValueEffect and Finish as delimiters for regions
that are scheduled atomically (renamed to BeginRegion, FinishRegion).

The BeginRegion node takes and produces an effect. For the uses that do
not care about the placement in the effect chain, it is ok to feed
graph->start() as an effect input.

The FinishRegion takes a value and an effect and produces a value and
an effect. It is important that any value or effect produced inside the
region is not used outside the region. The FinishRegion node is the only
way to smuggle an effect and a value out.

At the moment, this does not support control flow inside the region. Control flow would be hard.

During scheduling we do some sanity check, but the checks are not exhaustive. Here is what we check:
- the effect chain between begin and finish is linear (no splitting,
  single effect input and output).
- any value produced is consumed by the FinishRegion node.
- no control flow outputs.

Review URL: https://codereview.chromium.org/1399423002

Cr-Commit-Position: refs/heads/master@{#31265}