The idiv instruction has 2 registers as output. This needs to be
modeled so that the move optimizer won't incorrectly elide away
moves.

BUG=

Review URL: https://codereview.chromium.org/1818323002

Cr-Commit-Position: refs/heads/master@{#34978}

The CL also add guard nodes to places where we assume that certain
values are numbers.

Review URL: https://codereview.chromium.org/1821133002

Cr-Commit-Position: refs/heads/master@{#34977}

This was once meant to be used for JavaScript code stubs, but since we
found a better way to do code stubs using TurboFan, we don't need this
runtime entry and intrinsic anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1821123002

Cr-Commit-Position: refs/heads/master@{#34976}

  port b6419fa2 (r34959)

  original commit message:
  Now implemented as a builtin that delegates to the InstanceOfStub. That
  stub was parameterized to fallback to either Runtime_InstanceOf or to
  Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
  Once the feature stabilizes and the flag is no longer needed, we can get
  rid of this parameterization again.

BUG=

Review URL: https://codereview.chromium.org/1821113002

Cr-Commit-Position: refs/heads/master@{#34975}

  port 22523f25 (r34925)

  original commit message:
  This is in preparation for a CL that does the equivalent of http://crrev.com/1780193003 for ia32.

BUG=

Review URL: https://codereview.chromium.org/1823943002

Cr-Commit-Position: refs/heads/master@{#34974}

BUG=

Review URL: https://codereview.chromium.org/1824893002

Cr-Commit-Position: refs/heads/master@{#34973}

  port acbb968d (r34920)

  original commit message:
  In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
  Otherwise we will see G in a stack trace inside H.

  This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

BUG=

Review URL: https://codereview.chromium.org/1819273003

Cr-Commit-Position: refs/heads/master@{#34972}

  port b7aa4c3a (r34922)

  original commit message:
  Split ToNumberStub into the entry ToNumberStub, and two new stubs,
  StringToNumberStub and NonNumberToNumberStub, which can be used when we
  already know something about the input (i.e. in various branches of the
  code stubs, or in TurboFan graphs).

  Also introduce an appropriate StringToNumber simplified operator for
  TurboFan, that is pure and is lowered to an invocation of the newly
  added StringToNumberStub.

BUG=

Review URL: https://codereview.chromium.org/1816423002

Cr-Commit-Position: refs/heads/master@{#34971}

Rolling v8/third_party/android_tools to 19728471dd63a968668288488403286b68e4ae9e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1821943002

Cr-Commit-Position: refs/heads/master@{#34970}

BUG=v8:3915
LOG=N
R=adamk@chromium.org, littledan@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1823683004

Cr-Commit-Position: refs/heads/master@{#34969}

Flags --dump_wasm_module and --dump_wasm_module_path=/path/to/folder allow us to run a bunch of tests and capture all of the wasm module files including the ones that come from the .js and .cc tests which are built on the fly, as well as the asm2wasm tests.

The files are all uniquely named `HASH.{ok,failed}.wasm`.

This will be especilly useful for fuzz testing, but could also be used for other tests including non-V8 tests.

For now I manually hacked tools/testrunner/local/execution.py so that tools/run-tests.py can output the modules. We may want to ad a flag to run-tests.py proper if this turns out to be useful.

R=bradnelson@chromium.org, titzer@chromium.org, kcc@chromium.org

Review URL: https://codereview.chromium.org/1816583003

Cr-Commit-Position: refs/heads/master@{#34968}

Add missing conversions from other types to f32 in fround.
Restrict fround() to only float, double, signed, unsigned (no unions / intish).
Restrict Bitwise operations to intish, particularly |0, when not applied to a foreign function.

Adding more exhaustive tests of stdlib Math, move to a separate file.
Adding tests of interesting values for the stdlib asm.js functions.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1804243003

Cr-Commit-Position: refs/heads/master@{#34967}

Enables the Scanner to provide a better error message when errors occur
in escape sequences, numbers, strings, etc.

BUG=v8:4829, v8:3230
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1793913002

Cr-Commit-Position: refs/heads/master@{#34966}

* Better inlining
* Avoid vtable lookup for visitor

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1818013002

Cr-Commit-Position: refs/heads/master@{#34965}

Both of them shipped in Chrome 49 without incident.

Also move relevant tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1815773002

Cr-Commit-Position: refs/heads/master@{#34964}

BUG=

Review URL: https://codereview.chromium.org/1819813003

Cr-Commit-Position: refs/heads/master@{#34963}

This is necessary to ensure that "Called non callable" exception will get a proper message and stack trace even for calls at tail position.

BUG=chromium:595615, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818003002

Cr-Commit-Position: refs/heads/master@{#34962}

R=littledan@chromium.org
BUG=v8:4810
LOG=N

Review URL: https://codereview.chromium.org/1824613002

Cr-Commit-Position: refs/heads/master@{#34961}

STL requires comparison to be a strict weak ordering.

In particular the predicate should be antisymmetric:
f(x, y) implies !f(y, x).

BUG=v8:4848
LOG=NO

Review URL: https://codereview.chromium.org/1818043004

Cr-Commit-Position: refs/heads/master@{#34960}

Now implemented as a builtin that delegates to the InstanceOfStub. That
stub was parameterized to fallback to either Runtime_InstanceOf or to
Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
Once the feature stabilizes and the flag is no longer needed, we can get
rid of this parameterization again.

R=bmeurer@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1819813002

Cr-Commit-Position: refs/heads/master@{#34959}

Revert of Parser: Make skipping HTML comments optional. (patchset #6 id:140001 of https://codereview.chromium.org/1801203002/ )

Reason for revert:
Violates ES6 spec (crbug.com/4850), and implementation was over-eager. Will revert for now.

Original issue's description:
> Parser: Make skipping HTML comments optional.
>
> API change: This adds a new flag skip_html_comments to v8::ScriptOriginOptions. This flag controls whether V8 will attempt to honour HTML-style comments in JS sources.
>
> (That is: Gracefully ignore <!-- ... ---> in JS sources, which was a popular technique in the early days of JavaScript, to prevent non-JS-enabled browsers from displaying script sources to uses.)
>
> The flag defaults to 'true' when using v8::ScriptOrigin constructor, which preserves the existing behaviour. Embedders which are happy with the existing behaviour will thus not need any changes.
>
> BUG=chromium:573887
> LOG=Y
>
> Committed: https://crrev.com/91d344288aa51ed03eaaa1cb3e368ac1e82f0173
> Cr-Commit-Position: refs/heads/master@{#34904}

TBR=jochen@chromium.org,rossberg@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:573887, v8:4850
LOG=Y

Review URL: https://codereview.chromium.org/1817163003

Cr-Commit-Position: refs/heads/master@{#34958}

We don't want them to disappear from the stack traces.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818063002

Cr-Commit-Position: refs/heads/master@{#34957}

BUG=

Review URL: https://codereview.chromium.org/1823613002

Cr-Commit-Position: refs/heads/master@{#34956}

This change introduces wide prefix bytecodes to support wide (16-bit)
and extra-wide (32-bit) operands. It retires the previous
wide-bytecodes and reduces the number of operand types.

Operands are now either scalable or fixed size. Scalable operands
increase in width when a bytecode is prefixed with wide or extra-wide.

The bytecode handler table is extended to 256*3 entries. The
first 256 entries are used for bytecodes with 8-bit operands,
the second 256 entries are used for bytecodes with operands that
scale to 16-bits, and the third group of 256 entries are used for
bytecodes with operands that scale to 32-bits.

LOG=N
BUG=v8:4747,v8:4280

Review URL: https://codereview.chromium.org/1783483002

Cr-Commit-Position: refs/heads/master@{#34955}

The check in question will trigger because one of our unit tests still
emits the bytecode (i.e. unittests/BytecodeArrayBuilderTest) even when
the flag is turned on by default.

R=rmcilroy@chromium.org
TEST=unittests/BytecodeArrayBuilderTest.AllBytecodesGenerated

Review URL: https://codereview.chromium.org/1820753003

Cr-Commit-Position: refs/heads/master@{#34954}

Generated code performs distinct floating multiply and add/subtract
operations. Tests fail when GCC uses mul-add to calculate the
expected result since these instructions provide higher accuracy due
to the lack of an intermediate round.

R=machenbach@chromium.org, mbrandy@us.ibm.com, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1812823008

Cr-Commit-Position: refs/heads/master@{#34953}

Now that we have page-local remembered sets (due to refilling in page
granularity) we can perform all updates on the sets during compaction in
parallel without caching slots locally.

BUG=chromium:524425
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1811573002

Cr-Commit-Position: refs/heads/master@{#34952}

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1706053002

Cr-Commit-Position: refs/heads/master@{#34951}

Previous to this change, the dummy Return inside
InterpreterAssembler::Abort caused TurboFan to emit incorrect code for
handlers that made use of this call. The stack pointer would not be
incremented before tail calling into the next handler, causing it to
push on top on the caller's frame instead of overwriting it.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1819853002

Cr-Commit-Position: refs/heads/master@{#34950}

NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1817063002

Cr-Commit-Position: refs/heads/master@{#34949}

Bounds check hoisting was known to be buggy and has never been turned on.
Since Crankshaft is deprecated, nobody is going to spend time fixing it,
so let's just get rid of it.

BUG=v8:4155,v8:4849
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1823623002

Cr-Commit-Position: refs/heads/master@{#34948}

Note that this optimization only kicks in with --harmony-instanceof
being enabled as well. By itself this optimization itself does not
trigger.

R=bmeurer@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1817043002

Cr-Commit-Position: refs/heads/master@{#34947}

BUG=chromium:568949
LOG=n
TBR=kjellander@chromium.org, tandrii@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1822703002

Cr-Commit-Position: refs/heads/master@{#34946}

Code that we want to keep after warming up may have context-dependent
inline caches. Clear these to avoid running into IC misses after
deserialization.

R=vogelheim@chromium.org
BUG=v8:4836
LOG=N

Review URL: https://codereview.chromium.org/1811263002

Cr-Commit-Position: refs/heads/master@{#34945}

BUG=

Committed: https://crrev.com/b3bda50ddd9e30b718ae7972d9dd0d095113f634
Cr-Commit-Position: refs/heads/master@{#34892}

Review URL: https://codereview.chromium.org/1810083003

Cr-Commit-Position: refs/heads/master@{#34944}

BUG=v8:2999,v8:4751
LOG=n
NOTRY=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1820813003

Cr-Commit-Position: refs/heads/master@{#34943}

BUG=

Review URL: https://codereview.chromium.org/1815663002

Cr-Commit-Position: refs/heads/master@{#34942}

BUG=
LOG=no

Review URL: https://codereview.chromium.org/1812203002

Cr-Commit-Position: refs/heads/master@{#34941}

This rebaselines all our internal tests for error messages thrown by the
implementation of 'instanceof' to the new ES6 semantics. It also applies
a minor rephrasing to the messages in question.

R=rossberg@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1822663002

Cr-Commit-Position: refs/heads/master@{#34940}

The BytecodeArray shouldn't have changed since it was last loaded from the stack
frame, so this store is unecessary.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1807673009

Cr-Commit-Position: refs/heads/master@{#34939}