This implements a first version of support for constructor call inlining
in the inlining machinery. For now we can only inline calls where the
actual constructor and the original constructor coincide (i.e. no super
constructor calls). Note that the target of a super constructor call is
loaded with a runtime call, so there is no way for it to be constant
promoted at the moment.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1435873002

Cr-Commit-Position: refs/heads/master@{#31954}

With subclassing and @@toStringTag, %_ClassOf is not necessarily what
you want for ES6 anymore, so better avoid relying on %_ClassOf in our
builtins.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1439003002

Cr-Commit-Position: refs/heads/master@{#31953}

Rolling v8/tools/clang to 0b258f75323161e854038f30334e97ab6aa58eab

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1440623005

Cr-Commit-Position: refs/heads/master@{#31952}

The ~ operator is de-sugared into true^x, which was
being improperly handled.

Adding tests of most bitwise operators and several error cases.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1432423003

Cr-Commit-Position: refs/heads/master@{#31951}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1440813002

Cr-Commit-Position: refs/heads/master@{#31950}

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1440733002

Cr-Commit-Position: refs/heads/master@{#31949}

Presently the inline allocation step is a static value defined to be the minimum
of the step sizes over all the observers. The step occur every (approx.) step
byte. This is unfair to observers whose steps are not evenly divisible by the
min step size. For example, consider two observers with steps sizes of 512 and
576 bytes. Across 16kb allocated, you would expect the first observer to be hit
approximately 32 times, and the second observer to be hit approximately 28
times.

In reality, the observers get notified 30 and 15 times respectively. The reason
is that each step is 512 bytes, and since 576 is not evenly divisible by 512,
it gets notified much less frequently.

This CL fixes the problem by making the next step size be the minimum (over all
observers) of the remaining bytes to get to the step, making the steps fair.

BUG=
R=hpayer@chromium.org,ulan@chromium.org

Review URL: https://codereview.chromium.org/1427973006

Cr-Commit-Position: refs/heads/master@{#31948}

I have discovered need in those values when writing:

https://github.com/indutny/llnode

BUG=

Review URL: https://codereview.chromium.org/1436473002

Cr-Commit-Position: refs/heads/master@{#31947}

I don't see obvious implementations for mips64 and ppc64, so I would need
help for these two platforms.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1436943002

Cr-Commit-Position: refs/heads/master@{#31946}

Check whether a trampoline pool should be emitted after unblocking.
Otherwise, back-to-back sequences which block the trampoline pool can
cause it to be out of reach.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1433343002

Cr-Commit-Position: refs/heads/master@{#31945}

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1432223002

Cr-Commit-Position: refs/heads/master@{#31944}

Extend the element access specialization to also allow non-JSArray fast
packed elements, which now includes unaliased sloppy and strict
arguments.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1433193003

Cr-Commit-Position: refs/heads/master@{#31943}

Change sloppy and strict arguments objects to FAST_ELEMENTS for their
backing stores, which will allow us to optimize them easier. Also fixes
a bug in the elements accessors that was triggered by this change.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1433133003

Cr-Commit-Position: refs/heads/master@{#31942}

BUG=

Review URL: https://codereview.chromium.org/1436813002

Cr-Commit-Position: refs/heads/master@{#31941}

Review URL: https://codereview.chromium.org/1439583002

Cr-Commit-Position: refs/heads/master@{#31940}

This is for disabling 9.2.2. for release on arm64
(approximating a bit).

BUG=v8:4280
LOG=N
NOTRY=True
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1432183002

Cr-Commit-Position: refs/heads/master@{#31939}

Support lowering of Function.prototype.call in the JSBuiltinReducer,
which is actually straightforward because of the way we represent JS
calls in TurboFan.  Currently we cannot inline the actual target yet,
since inlining still runs before typed lowering, but that will be
possible as well soon(ish).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1439533002

Cr-Commit-Position: refs/heads/master@{#31938}

Use 64-bit add for address.

TEST=mjsunit/sparse-array.js, others.
BUG=

Review URL: https://codereview.chromium.org/1435793002

Cr-Commit-Position: refs/heads/master@{#31937}

Rolling v8/buildtools to 4a95614772d9bcbd8bc197e1d9bd034e088fc740

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1439503002

Cr-Commit-Position: refs/heads/master@{#31936}

   port 1e277012 (r31914)

   original commit message:
   Avoid write barriers when storing values in the root set, and use
   cheaper write barriers for storing maps or tagged pointers. Also
   improve the generated code for write barriers, utilizing the out
   of line code mechanism that is available to TurboFan backends,
   which moves the unlikely case out of the hot path.

BUG=

Review URL: https://codereview.chromium.org/1435743003

Cr-Commit-Position: refs/heads/master@{#31935}

X87: Support fast-path allocation for subclass constructors with correctly initialized initial maps.

  port b9d25d86 (r31913)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1434853002

Cr-Commit-Position: refs/heads/master@{#31934}

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1409073016

Cr-Commit-Position: refs/heads/master@{#31933}

Changing this value is not guaranteed to work yet, but it needs to be
an arg in order to experiment with it.

Review URL: https://codereview.chromium.org/1427343003

Cr-Commit-Position: refs/heads/master@{#31932}

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1413833013

Cr-Commit-Position: refs/heads/master@{#31931}

This CL is in preparation for the API change introduced in http://crrev.com/1407313004.

BUG=

Review URL: https://codereview.chromium.org/1434693008

Cr-Commit-Position: refs/heads/master@{#31930}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1435603003

Cr-Commit-Position: refs/heads/master@{#31929}

Popcnt is implemented as an optional operator, which is only implementd by x64
at the moment.

Review URL: https://codereview.chromium.org/1424173006

Cr-Commit-Position: refs/heads/master@{#31928}

Port 1e277012

Original commit message:
    Avoid write barriers when storing values in the root set, and use
    cheaper write barriers for storing maps or tagged pointers. Also
    improve the generated code for write barriers, utilizing the out
    of line code mechanism that is available to TurboFan backends,
    which moves the unlikely case out of the hot path.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1431923003

Cr-Commit-Position: refs/heads/master@{#31927}

PPC: Support fast-path allocation for subclass constructors with correctly initialized initial maps.

Port b9d25d86

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1434793002

Cr-Commit-Position: refs/heads/master@{#31926}

Like its 32-bit counterpart, this is not implemented on PPC.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1438583002

Cr-Commit-Position: refs/heads/master@{#31925}

 of https://codereview.chromium.org/1428943004/ )"

This reverts commit 5f4828a1.

Maintaining the behavior of processing both ranges with spill ranges,
as well as those with spill operands.

BUG=

Review URL: https://codereview.chromium.org/1406223010

Cr-Commit-Position: refs/heads/master@{#31924}

BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1423803009

Cr-Commit-Position: refs/heads/master@{#31923}

Jic and jialc compact branch ops are fixed as they does not have 'forbidden slot' restriction. Also COP1 branches (CTI instructions) added to IsForbiddenAfterBranchInstr().

TEST=cctest/test-disasm-mips/Type0
BUG=

Review URL: https://codereview.chromium.org/1423493006

Cr-Commit-Position: refs/heads/master@{#31922}

The minimum allocation limit already enforces this constraint for normal GCs.

GCs triggered by the memory reducer and external limit should work for all heap sizes.

BUG=chromium:552305
LOG=NO

Review URL: https://codereview.chromium.org/1418293006

Cr-Commit-Position: refs/heads/master@{#31921}

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1410883009

Cr-Commit-Position: refs/heads/master@{#31920}

Skips some more tests which started failing after https://codereview.chromium.org/1414183006 landed.

BUG=v8:4280
LOG=N
NOTRY=True

Review URL: https://codereview.chromium.org/1412343009

Cr-Commit-Position: refs/heads/master@{#31919}

Generated code performs distinct floating multiply and add/subtract
operations.  Tests fail when GCC uses fmadd/fmsub to calculate the
expected result since these instructions provide higher accuracy due
to the lack of an intermediate round.

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1416123007

Cr-Commit-Position: refs/heads/master@{#31918}

Review URL: https://codereview.chromium.org/1419793014

Cr-Commit-Position: refs/heads/master@{#31917}

This patch extends the typed lowering with a specialized version of 'instanceof' that is used if the "class", i.e. the constructor function, is a known constant.

Unittests check that replacement occurs as intended. Functional correctness is ensured by extensive unit tests covering instanceof already in the testsuite.

TESTS=unittests/JSTypedLoweringTest.{JSInstanceOfSpecializationWithSmiCheck,JSInstanceOfSpecializationWithoutSmiCheck,JSInstanceOfNoSpecialization}

Review URL: https://codereview.chromium.org/1407413014

Cr-Commit-Position: refs/heads/master@{#31916}

The body descriptor supports different visiting policies: it could visit or skip
the code entry and it could visit or skip next function field.

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1422773007

Cr-Commit-Position: refs/heads/master@{#31915}