Besides reducing code duplication, this makes it easier to change the
implementation, which may be necessary to properly support eval calls
in arrow function parameter initializers.

Review URL: https://codereview.chromium.org/1573363002

Cr-Commit-Position: refs/heads/master@{#33219}

This patch moves the semantics of 'const' in sloppy mode to match those
in strict mode, that is, const makes lexical (let-like) bindings, must
have an initializer, and does not create properties of the global object.

R=adamk
LOG=Y
BUG=v8:3305
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1571873004

Cr-Commit-Position: refs/heads/master@{#33218}

As V8 becomes more and more spec-compliant, Promise polyfill libraries
like core.js expect fully correct. However, our Promises do not yet
support Symbol.species. Therefore, a case like

```
var test = new Promise(function(){});
test.constructor = function(){};
Promise.resolve(test)
```

would lead to an unhandled Promise rejection, whereas it should not
because test.constructor[Symbol.species] is undefined, so test.then
should end up constructing %Promise% as a fallback, rather than
calling test.constructor as if it were a constructor, which leads
this error checking code to throw.

For now, this patch removes the error checking code (which was not
present until recently). In an interactive test using core.js, the
error message on the console goes away with this patch. When @@species
support is in place, this patch can be reverted. A regression test
is added which checks for the same thing.

Partially reverted patch was originally out for review at
https://codereview.chromium.org/1531073004

BUG=v8:4633
LOG=Y
R=adamk,caitp88@gmail.com

Review URL: https://codereview.chromium.org/1578893002

Cr-Commit-Position: refs/heads/master@{#33217}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1564393003

Cr-Commit-Position: refs/heads/master@{#33216}

test-validator-asm -> test-asm-validator.

BUG=
TBR=titzer@chromium.org

Review URL: https://codereview.chromium.org/1574943004

Cr-Commit-Position: refs/heads/master@{#33215}

Does not remove the extra private state added, as doing so seems to break the
debugger.

Fixes new Test262 tests:
- built-ins/Promise/race/same-resolve-function
- built-ins/Promise/race/same-reject-function

BUG=v8:4632
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1538853002

Cr-Commit-Position: refs/heads/master@{#33214}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:575861

Review URL: https://codereview.chromium.org/1573053003

Cr-Commit-Position: refs/heads/master@{#33213}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1573143002

Cr-Commit-Position: refs/heads/master@{#33212}

Adds wide context slot load / store operations. Adds LdaContextSlotWide
and StaContextSlotWide bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1572283002

Cr-Commit-Position: refs/heads/master@{#33211}

BUG=chromium:535160
LOG=n
NOTRY=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1573913003

Cr-Commit-Position: refs/heads/master@{#33210}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1571563003

Cr-Commit-Position: refs/heads/master@{#33209}

This CL changes the color for encoding black and grey. Moreover, it introduces a higher level live object iterator.

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1517993003

Cr-Commit-Position: refs/heads/master@{#33208}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1568623004

Cr-Commit-Position: refs/heads/master@{#33207}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:575369

Review URL: https://codereview.chromium.org/1577813002

Cr-Commit-Position: refs/heads/master@{#33206}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1575913002

Cr-Commit-Position: refs/heads/master@{#33205}

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1574643002

Cr-Commit-Position: refs/heads/master@{#33204}

A concurrent sweeper thread can access the same markbit cell as the main thread
during right trimming a fixed array, resulting in a data race on a markbit cell.
Previously we checked whether we were currently marking incrementally, filtering
out this case.

The current check has the benefit of keeping live_bytes accurate (modulo other
bugs) until the sweeper starts.

BUG=chromium:576193
LOG=N

Review URL: https://codereview.chromium.org/1576853002

Cr-Commit-Position: refs/heads/master@{#33203}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1578723002

Cr-Commit-Position: refs/heads/master@{#33202}

Escape analysis will eliminate the context, if possible. Materialization
must then ensure that the materialized object has the right map, and that
the context register is set accordingly.

R=jarin@chromium.org
BUG=569530,v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1572293002

Cr-Commit-Position: refs/heads/master@{#33201}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1565153002

Cr-Commit-Position: refs/heads/master@{#33200}

Until now we've been allowing unmarked asm code
through the typer. Start rejecting it.

Adding a cctest that asm modules missing an export return
fail validation.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1569423002

Cr-Commit-Position: refs/heads/master@{#33199}

In particular, Claim doesn't work with a negative size, so ensure that
it is positive.

BUG=

Review URL: https://codereview.chromium.org/1565193002

Cr-Commit-Position: refs/heads/master@{#33198}

Get the BE bots green in the short term.

BUG=

Review URL: https://codereview.chromium.org/1571243002

Cr-Commit-Position: refs/heads/master@{#33197}

  port fc5c7e04 (r33172)

  original commit message:
  There's no reason to have JavaScript wrappers for those accessors,
  since the meat is already in hand-written native code (via %_DateField).
  First step now to put them into native builtins. Next step will be to
  completely remove %_DateField.

BUG=

Review URL: https://codereview.chromium.org/1576813003

Cr-Commit-Position: refs/heads/master@{#33196}

Rolling v8/tools/clang to 0e2c562e4ee6e1a4a2f35b1bd60b2e208cd00838

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1572713003

Cr-Commit-Position: refs/heads/master@{#33195}

Removed unused name_ field, made bitfield 16-bits long, and moved it to
the start of the struct, resulting in a reduction of 8 bytes on both
32 and 64-bit platforms.

Most other changes (which prompted this work) are cosmetic:r
  - Combined redundant enums
  - Named enum values kConsistently
  - Consistently use booleans in bitfield, using enum values
    only for passing information into NewFunctionLiteral
  - Removed unneeded arguments from NewFunctionLiteral, reducing
    clutter at callsites
  - Added const correctness consistently

Review URL: https://codereview.chromium.org/1566053002

Cr-Commit-Position: refs/heads/master@{#33194}

This at least puts something in the tree demonstrating the breakage;
it can be moved into regress/ if we fix it.

R=littledan@chromium.org
BUG=v8:4577
LOG=n

Review URL: https://codereview.chromium.org/1576503002

Cr-Commit-Position: refs/heads/master@{#33193}

Originally, only BindingIdentifiers were a legal operand for the `...` ellipsis
in a function rest parameter. This has since changed, allowing the rest array
to be destructured.

The grammar is now the following:

```
FunctionRestParameter[Yield]:
    BindingRestElement[?Yield]

BindingRestElement[Yield]:
    ... BindingIdentifier[?Yield]
    ... BindingPattern[?Yield]
```

*Spec change: https://github.com/tc39/ecma262/commit/d322357e6be95bc4bd3e03f5944a736aac55fa50
*TC39 Discussion: https://github.com/tc39/tc39-notes/blob/master/es7/2015-07/july-28.md#66-bindingrestelement-should-allow-a-bindingpattern-ala-assignmentrestelement

BUG=v8:4627, v8:2159
LOG=N
R=littledan@chromium.org, adamk@chromium.org, wingo@igalia.com, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1532873004

Cr-Commit-Position: refs/heads/master@{#33192}

Port fc5c7e04

Original commit message:
There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

BUG=
TEST=test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-10, test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-11, test262/built-ins/Date/S15.9.3.1_A5_T1

Review URL: https://codereview.chromium.org/1569353002

Cr-Commit-Position: refs/heads/master@{#33191}

Encode "parenthesized" status of parenthesized Expressions to prevent
them from being treated as Patterns.

BUG=v8:4657, v8:811
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1570793002

Cr-Commit-Position: refs/heads/master@{#33190}

Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #1 id:1 of https://codereview.chromium.org/1565263002/ )

Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}

Fixed a bug in VisitForInAssignment. After visiting the object the value
to be stored was not loaded back to the accumulator. Also added two tests
to check this case.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1571753002

Cr-Commit-Position: refs/heads/master@{#33188}

Port fc5c7e04

Original commit message:
    There's no reason to have JavaScript wrappers for those accessors,
    since the meat is already in hand-written native code (via %_DateField).
    First step now to put them into native builtins. Next step will be to
    completely remove %_DateField.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1569173003

Cr-Commit-Position: refs/heads/master@{#33187}

Adds support for the CallRuntimeForPair bytecode to the Bytecode Graph
Builder. Modifies the FrameState support to allow updating of output
registers.

Also adds Eval tests to test-run-bytecode-graph-builder since these are
enabled by CallRuntimeForPair support.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1570623007

Cr-Commit-Position: refs/heads/master@{#33186}

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816

Review URL: https://codereview.chromium.org/1564923007

Cr-Commit-Position: refs/heads/master@{#33185}

Adds support for calling eval to the interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1508293003

Cr-Commit-Position: refs/heads/master@{#33184}

This patch introduces a mechanism for changing the scope of temporary
variables, which is necessary for rewriting arrow parameter
initializers.

It also fixes a potential bug in AstExpressionVisitor, which did not
visit the automatically generated members of ForEachStatement.

Fixes test/mjsunit/harmony/regress/regress-4658.js

R=rossberg@chromium.org
BUG=v8:4658
LOG=N

Review URL: https://codereview.chromium.org/1564343002

Cr-Commit-Position: refs/heads/master@{#33183}

Matches https://crrev.com/366832

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1551453002

Cr-Commit-Position: refs/heads/master@{#33182}

Adds support for calling runtime functions which return a pair of
values. Adds the bytecode CallRuntimePair. Also adds support to TurboFan
for calling stubs which return multiple values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568493002

Cr-Commit-Position: refs/heads/master@{#33181}

R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1543553002

Cr-Commit-Position: refs/heads/master@{#33180}