TEST=mjsunit/compiler/regress-int32array-outofbounds-nan
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/803483002

Cr-Commit-Position: refs/heads/master@{#25793}

FINAL implies OVERRIDE, which in turn implies virtual, so there's no need to use
more than one of these. The Google C++ style guide even requires this, see
http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Inheritance.

While we're here, port r24662 to x87.

The net result is that v8 compiles again with a current clang.

BUG=v8:3753
LOG=y

Review URL: https://codereview.chromium.org/797943002

Cr-Commit-Position: refs/heads/master@{#25792}

BUG=

Review URL: https://codereview.chromium.org/794113004

Cr-Commit-Position: refs/heads/master@{#25791}

- Decouple JSBuiltinReducer from JSTypedLowering.
- Unify JSTypedLowering::ReduceJSToXXX() lowering.
- Cleanup several includes and forward declarations.
- Unify helper methods.

TEST=cctest
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/797903003

Cr-Commit-Position: refs/heads/master@{#25790}

Review URL: https://codereview.chromium.org/769113002

Cr-Commit-Position: refs/heads/master@{#25789}

Otherwise, V8 won't compile with the latest clang anymore

BUG=v8:3753
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/797583004

Cr-Commit-Position: refs/heads/master@{#25788}

Avoid explicitly branching to the false label on unordered when the condition
on the true branch will not catch the unordered case and let the code fall
through.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/794203003

Cr-Commit-Position: refs/heads/master@{#25787}

This reverts commit 8a6cbf0a.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/788313002

Cr-Commit-Position: refs/heads/master@{#25786}

A helpful utility which converts iterables and array-like objects into Arrays

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.from

LOG=Y
BUG=v8:3336
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/363833006

Cr-Commit-Position: refs/heads/master@{#25785}

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/794213002

Cr-Commit-Position: refs/heads/master@{#25784}

R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}

LOG=N
R=arv@chromium.org, dslomov@chromium.org, marja@chromium.org
BUG=

Review URL: https://codereview.chromium.org/792083002

Cr-Commit-Position: refs/heads/master@{#25782}

This allows the setting to be overridable by embedders,
at the cost of forcing embedders that don't build v8
using standalone.gypi to add this setting to their build
config.

BUG=chromium:421063
LOG=Y

Review URL: https://codereview.chromium.org/794583002

Cr-Commit-Position: refs/heads/master@{#25781}

It could happen that we shrink a live object on the main thread (e.g.
MigrateFastToSlow) while we're sweeping the same page. The main
thread first creates a filler object that the release-stores the new
map. Therefore it's important to barrier load the map word of live
objects from the sweeper thread.

BUG=none
R=ulan@chromium.org,hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/797623002

Cr-Commit-Position: refs/heads/master@{#25780}

Rolling v8/buildtools/clang_format/script to 81edd558fea5dd7855d67a1dc61db34ae8c1fd63

Rolling v8/buildtools to 05dd6a24723170d7c6ff35b537ee02947f619891

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/797613002

Cr-Commit-Position: refs/heads/master@{#25779}

DevTools expects 2 events on Promise.resolve()/Promise.reject():
creation & settlement. The first one was missing.

R=ulan@chromium.org, yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/792383003

Cr-Commit-Position: refs/heads/master@{#25778}

R=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/793323002

Cr-Commit-Position: refs/heads/master@{#25777}

To make space in the type bitset, remove Function, RegExp, and Buffer
types for now, since they aren't really relied upon anyway.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/795993002

Cr-Commit-Position: refs/heads/master@{#25776}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/793303002

Cr-Commit-Position: refs/heads/master@{#25775}

BUG=440880
R=yangguo@chromium.org,dcarney@chromium.org,vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/796823002

Cr-Commit-Position: refs/heads/master@{#25774}

The instruction selector now selects pseudo instructions: CompareAndBranch or
TestAndBranch which are associated with their continuations so that generic
code in the code generator will treat them as branch instruction and will be
able to apply optimization like avoiding branches when the code can falltrhough.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/798553002

Cr-Commit-Position: refs/heads/master@{#25773}

R=bmeurer@chromium.org
BUG=441107
LOG=N

Review URL: https://codereview.chromium.org/795043003

Cr-Commit-Position: refs/heads/master@{#25772}

Review URL: https://codereview.chromium.org/747283005

Cr-Commit-Position: refs/heads/master@{#25771}

It's never used.

BUG=none
R=dcarney@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/797543002

Cr-Commit-Position: refs/heads/master@{#25770}

BUG=none
R=mvstanton@chromium.org,yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/791363002

Cr-Commit-Position: refs/heads/master@{#25769}

Adapted from Raymond Toy's (rtoy@chromium.org) port, extracted from fdlibm's pow implementation.

R=rtoy@chromium.org
BUG=v8:3579
LOG=N

Review URL: https://codereview.chromium.org/786823003

Cr-Commit-Position: refs/heads/master@{#25768}

V8 didn't report compile events on pause before this patch. These events can be important for listener. For example, DevTools allows user to execute some JS code on pause and needs to show correct stack trace in message from it.

BUG=396013
R=yurys@chromium.org

Review URL: https://codereview.chromium.org/781623004

Cr-Commit-Position: refs/heads/master@{#25767}

This ports https://codereview.chromium.org/769413004 to v8
DEPS.

BUG=chromium:438401
LOG=n
TBR=jshin@chromium.org

Review URL: https://codereview.chromium.org/796813002

Cr-Commit-Position: refs/heads/master@{#25766}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/794113002

Cr-Commit-Position: refs/heads/master@{#25765}

Review URL: https://codereview.chromium.org/793753002

Cr-Commit-Position: refs/heads/master@{#25764}

This completes the first round of optimizations for Map and Set.
All non-key-dependent methods now have a Hydrogen version, and
for keyed methods, string versions are optimized.

Review URL: https://codereview.chromium.org/796503002

Cr-Commit-Position: refs/heads/master@{#25763}

TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/770333005

Cr-Commit-Position: refs/heads/master@{#25762}

R=rossberg@chromium.org
BUG=v8:2198
LOG=Y

Review URL: https://codereview.chromium.org/792543002

Cr-Commit-Position: refs/heads/master@{#25761}

R=arv@chromium.org,marja@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/788143004

Cr-Commit-Position: refs/heads/master@{#25760}

They both now run fast (due to utilizing transitions instead of always
creating new maps) and sealed or non-extensible objects can stay in
fast mode after transitioning.

This almost entirely reuses the code for transitioning objects
frozen by Object.freeze(), with the added benefit of freeing
up a bit on the map (we no longer keep track of frozen-ness,
as that bit wasn't used for anything interesting).

BUG=v8:3662,chromium:115960
LOG=y

Review URL: https://codereview.chromium.org/776143005

Cr-Commit-Position: refs/heads/master@{#25759}

Review URL: https://codereview.chromium.org/779173010

Cr-Commit-Position: refs/heads/master@{#25758}

The null constructor they had previously could be observed as crashes in
the V8 API's Object::CreationContext() method and in Object.observe.

BUG=v8:3750
LOG=n
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/787763005

Cr-Commit-Position: refs/heads/master@{#25757}

Revert of Avoid number range holes in bitset types. (patchset #5 id:80001 of https://codereview.chromium.org/759013003/)

Reason for revert:
For breaking the waterfall (run-json-stringify test).

Original issue's description:
> Avoid number range holes in bitset types.
>
> BUG=

TBR=rossberg@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/794663002

Cr-Commit-Position: refs/heads/master@{#25756}

BUG=
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/795633002

Cr-Commit-Position: refs/heads/master@{#25755}

BUG=

Review URL: https://codereview.chromium.org/759013003

Cr-Commit-Position: refs/heads/master@{#25754}