This uses the bots introduced here:
https://codereview.chromium.org/1581803003/

BUG=chromium:535160
LOG=n
NOTRY=true
NOPRESUBMIT=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1588543002

Cr-Commit-Position: refs/heads/master@{#33263}

ReportFailedAccessCheck() sometimes doesn't throw an exception (it's up
to the embedder). Pretend that OrdinaryDefineOwnProperty() succeeded in
that case. This is consistent with existing behavior of other methods:
- JSObject::DefineOwnPropertyIgnoreAttributes
- JSObject::SetPropertyWithFailedAccessCheck
- Object::SetPropertyWithAccessor

See also commit f66c3f5c.

BUG=chromium:574217
LOG=n
R=neis@chromium.org

Review URL: https://codereview.chromium.org/1580823002

Cr-Commit-Position: refs/heads/master@{#33262}

R=jarin@chromium.org
BUG=v8:4650
LOG=Y

Review URL: https://codereview.chromium.org/1574113009

Cr-Commit-Position: refs/heads/master@{#33261}

(fast_handler *has* a more specific type; the TODO is no longer applicable.)

R=epertoso@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1577233003

Cr-Commit-Position: refs/heads/master@{#33260}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1587483003

Cr-Commit-Position: refs/heads/master@{#33259}

The API functions are always in sloppy mode, so receiver is always a
JSReceiver once the actual call trampoline runs, no need to check again
in various places.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1575973006

Cr-Commit-Position: refs/heads/master@{#33258}

Rolling v8/tools/clang to afad7aa23b146a86be9bc335caaac5bcfa72f390

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1584673002

Cr-Commit-Position: refs/heads/master@{#33257}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1583603002

Cr-Commit-Position: refs/heads/master@{#33256}

Review URL: https://codereview.chromium.org/1580123002

Cr-Commit-Position: refs/heads/master@{#33255}

http://tc39.github.io/ecma262/#sec-destructuring-assignment-static-semantics-early-errors
requires that DestructuringAssignmentTargets which do not match Pattern productions,
must return true for IsValidSimpleAssignmentTarget.

This change rejects parenthesized patterns with a SyntaxError.

BUG=v8:4662, v8:811
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, nikolaos@chromium.org

Review URL: https://codereview.chromium.org/1585473002

Cr-Commit-Position: refs/heads/master@{#33254}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1584573002

Cr-Commit-Position: refs/heads/master@{#33253}

Failing to do so results in out-of-date marking information, because live bytes
is not properly adjusted.

This CL adds support for right trimming ByteArray and properly DCHECKs that we
do not left trim  ByteArray (as we already do for FixedTypedArrayBase).

BUG=

Review URL: https://codereview.chromium.org/1577263003

Cr-Commit-Position: refs/heads/master@{#33252}

R=ahaas@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575167

Review URL: https://codereview.chromium.org/1577803002

Cr-Commit-Position: refs/heads/master@{#33251}

BUG=v8:4661, v8:4488
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1575133003

Cr-Commit-Position: refs/heads/master@{#33250}

BUG=

Review URL: https://codereview.chromium.org/1573953002

Cr-Commit-Position: refs/heads/master@{#33249}

No functional change.  This is prep for fixing test failures in wasm tests.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583523002

Cr-Commit-Position: refs/heads/master@{#33248}

NOTRY=true
TBR=rmcilroy@chromium.org, neis@chromium.org

Review URL: https://codereview.chromium.org/1574343002

Cr-Commit-Position: refs/heads/master@{#33247}

The hash calculation was dependent on upper part of |inner_pointer| and caused non-deterministic cache miss events which in turn caused non-deterministic progress of pages sweeping (see GcSafeFindCodeForInnerPointer()).

Review URL: https://codereview.chromium.org/1582573002

Cr-Commit-Position: refs/heads/master@{#33246}

There's no need to mark these as possibly-direct-eval, since all such an
eval-tagged string will ever get passed is the array of string parts, which
will be immediately returns (since it's not a string). It will
never do a lookup in the current scope, nor (in sloppy mode) introduce
new declarations.

This patch is not intended to change behavior, but I've added tests that
demonstrate the stuff explained in the preceding paragraph.

Review URL: https://codereview.chromium.org/1580463003

Cr-Commit-Position: refs/heads/master@{#33245}

Failing chromium layout tests were marked for rebaselining.

Addition to original CL (https://codereview.chromium.org/1580693002/):
Skip some more ignition tests.

BUG=v8:3931,v8:1543
LOG=Y
R=hablich@chromium.org
CC=verwaest@chromium.org, rossberg@chromium.org,rmcilroy, oth

Review URL: https://codereview.chromium.org/1580783002

Cr-Commit-Position: refs/heads/master@{#33244}

This fixes a number of crashes where other code was assuming there would
be at least one deopt point in all optimized functions (i.e., the
StackCheck) but we weren't producing any.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1572333002

Cr-Commit-Position: refs/heads/master@{#33243}

No need to distribute the setup of the Function global property across
three different places, instead do everything in a single place during
bootstrapping.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1577703005

Cr-Commit-Position: refs/heads/master@{#33242}

That will allow for adding private symbols to JSProxies in a follow-up
change

BUG=chromium:571365
R=neis@chromium.org,verwaest@chromium.org,rossberg@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1575423002

Cr-Commit-Position: refs/heads/master@{#33241}

R=verwaest@chromium.org
BUG=chromium:576662,v8:1543
LOG=y

Review URL: https://codereview.chromium.org/1580723003

Cr-Commit-Position: refs/heads/master@{#33240}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:576560

Review URL: https://codereview.chromium.org/1574063005

Cr-Commit-Position: refs/heads/master@{#33239}

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1574263002

Cr-Commit-Position: refs/heads/master@{#33238}

Adds support for LOOKUP_SLOT_CALL calls to the interpreter. Also changes
VisitCall to keep callee and reciever consecutive to avoid register
shuffles when performing LOOKUP_SLOT_CALL calls. Adds tests for the
interpreter and bytecode graph generator.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568323002

Cr-Commit-Position: refs/heads/master@{#33237}

Revert of [Proxies] Ship Proxies + Reflect (patchset #2 id:20001 of https://codereview.chromium.org/1580693002/ )

Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream first.

https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/3587
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3873

Original issue's description:
> [Proxies] Ship Proxies + Reflect
>
> BUG=v8:3931,v8:1543
> LOG=Y
> R=verwaest@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/9ce5162fd2a36daf318e0ec3838cd90f4e179168
> Cr-Commit-Position: refs/heads/master@{#33234}

TBR=rossberg@chromium.org,verwaest@chromium.org,hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3931,v8:1543

Review URL: https://codereview.chromium.org/1579573004

Cr-Commit-Position: refs/heads/master@{#33236}

- Simplify the variable-length pop sequence on entry. (It now uses
  smaller code with no branches.)
- Use conditional compare to merge branches where appropriate.
- Make use of Ldrsw + UntagSmiFieldMemOperand to load smis more
  efficiently.
- Only load 'undefined' and 'null' once per builtin.
- A few other small improvements.

BUG=

Review URL: https://codereview.chromium.org/1576403002

Cr-Commit-Position: refs/heads/master@{#33235}

BUG=v8:3931,v8:1543
LOG=Y
R=verwaest@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1580693002

Cr-Commit-Position: refs/heads/master@{#33234}

We use a scratchpad to remember visited allocation sites for post processing
(making tenure decisions). The previous implementation used a rooted FixedArray
with constant length (256) to remember all sites. Updating the scratchpad is a
bottleneck in any parallel/concurrent implementation of newspace evacuation.

The new implementation uses a HashMap with allocation sites as keys and
temporary counts as values. During evacuation we collect a local hashmap of
visited allocation sites. Upon merging the local hashmap back into a global one
we update potential forward pointers of compacted allocation sites.  The
scavenger can directly enter its entries into the global hashmap. Note that the
actual memento found count is still kept on the AllocationSite as it needs to
survive scavenges and full GCs.

BUG=chromium:524425
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1535723002

Cr-Commit-Position: refs/heads/master@{#33233}

Change the CompilationInfo::IsCodePreAgingActive() predicate to CompilationInfo::GeneratePreagingPrologue() and handle the case of WASM functions, which should not be aged.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1577193003

Cr-Commit-Position: refs/heads/master@{#33232}

This migrates the remaining Date builtins to C++ and removes obsolete
intrinsics and JavaScript wrappers. This reduces the overhead imposed
by the Date builtins, and will allow us to optimize them later in the
TurboFan compiler, while the interpreter doesn't need to worry about
them.

R=yangguo@chromium.org
BUG=chromium:576574
LOG=n

Committed: https://crrev.com/1e51af1a5c80b1650de47dd4bc8f846fa2d85281
Cr-Commit-Position: refs/heads/master@{#33228}

Review URL: https://codereview.chromium.org/1579613002

Cr-Commit-Position: refs/heads/master@{#33231}

Revert of [builtins] Refactor the remaining Date builtins. (patchset #2 id:20001 of https://codereview.chromium.org/1579613002/ )

Reason for revert:
[Sheriff] Breaks https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/5711

Original issue's description:
> [builtins] Refactor the remaining Date builtins.
>
> This migrates the remaining Date builtins to C++ and removes obsolete
> intrinsics and JavaScript wrappers. This reduces the overhead imposed
> by the Date builtins, and will allow us to optimize them later in the
> TurboFan compiler, while the interpreter doesn't need to worry about
> them.
>
> R=yangguo@chromium.org
> BUG=chromium:576574
> LOG=n
>
> Committed: https://crrev.com/1e51af1a5c80b1650de47dd4bc8f846fa2d85281
> Cr-Commit-Position: refs/heads/master@{#33228}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:576574

Review URL: https://codereview.chromium.org/1574223002

Cr-Commit-Position: refs/heads/master@{#33230}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1579573003

Cr-Commit-Position: refs/heads/master@{#33229}

This migrates the remaining Date builtins to C++ and removes obsolete
intrinsics and JavaScript wrappers. This reduces the overhead imposed
by the Date builtins, and will allow us to optimize them later in the
TurboFan compiler, while the interpreter doesn't need to worry about
them.

R=yangguo@chromium.org
BUG=chromium:576574
LOG=n

Review URL: https://codereview.chromium.org/1579613002

Cr-Commit-Position: refs/heads/master@{#33228}

Cr-Commit-Position: refs/heads/master@{#33227}

BUG=

Review URL: https://codereview.chromium.org/1573343002

Cr-Commit-Position: refs/heads/master@{#33226}

This patch makes Promise.prototype.then use @@species as specified
in ES2015. The fix is hoped for by certain users, such as legacy
core.js versions which encounter an unhandled Promise reject (complete
with an ugly console message) when Promise subclassing is supported
in a mostly correct way, and we do error checking on Promise
constructors, but @@species is not supported.

BUG=chromium:575314,v8:4633
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1577223002

Cr-Commit-Position: refs/heads/master@{#33225}

This CL introduces ExternalStringResourceBase::IsCompressible.

This CL is a preparation for CompressibleString, which can
be compressed for memory reduction in Blink. We've found that
JavaScript strings account for a relatively large part of Blink
memory usage, and we are now trying to replace JavaScript String/
AtomicString with CompressibleString.

When a string is compressed, the original char data is deleted
and V8 pointer cache becomes invalid. This CL introduces
isCompressible  property and if an external string's isCompressble
return true, this is stored short_external_*_map instead of
external_*_map so that V8 always requires the char pointer whenever
V8 needs the string data.

BUG=chromium:574317
LOG=n

Review URL: https://codereview.chromium.org/1490193002

Cr-Commit-Position: refs/heads/master@{#33224}