BUG=

Review URL: https://codereview.chromium.org/1292583004

Cr-Commit-Position: refs/heads/master@{#30252}

JSObject::UnregisterPrototypeUser relies on the index of the weak
fixed array entry not to change.

See commit 1e65e201.

There is no bug currently, because we would only re-allocate if there is no empty slot left. In which case there is no actual compaction going on during re-allocation.

R=jkummerow@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1294883004

Cr-Commit-Position: refs/heads/master@{#30251}

BUG=

Review URL: https://codereview.chromium.org/1299213002

Cr-Commit-Position: refs/heads/master@{#30250}

BUG=chromium:455207
LOG=n
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1040703003

Cr-Commit-Position: refs/heads/master@{#30249}

Instead of installing them on the JS builtins object and later
grab them from there.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1296163003

Cr-Commit-Position: refs/heads/master@{#30248}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1292753004

Cr-Commit-Position: refs/heads/master@{#30247}

This is to avoid holding onto the function context of prologue.js.

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1285133009

Cr-Commit-Position: refs/heads/master@{#30246}

TBR=hablich@chromium.org
BUG=v8:4381

Review URL: https://codereview.chromium.org/1295513004

Cr-Commit-Position: refs/heads/master@{#30245}

This mainly changes how we share ToBoolean, ToNumber and ToString between
native scripts. Instead of putting them on the js builtins object, we now
explicitly export and import those functions.

I also had to change the import/export mechanism slightly. Previously,
exports and imports are hooked up after all native scripts have been
executed. This means that imported functions cannot be called at the time
the native script is executed.

However, since ToBoolean (and also e.g. ObjectDefineProperties) is called
in v8natives.js, I changed the mechanism so that exports from previous
native scripts (runtime.js for ToBoolean) is imported immediately and can
be called.

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1302533002

Cr-Commit-Position: refs/heads/master@{#30244}

Embedders must not provide invalid pointers for external backing stores.

BUG=chromium:522128
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1289373004

Cr-Commit-Position: refs/heads/master@{#30243}

Rolling v8/third_party/android_tools to 9e9b6169a098bc19986e44fbbf65e4c29031e4bd

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1303573003

Cr-Commit-Position: refs/heads/master@{#30242}

port f4c079d4 (r30107).

original commit message:

    There's no need to have one InstanceType per SIMD primitive type (this
    will not scale long-term).  Also reduce the amount of code duplication
    and make it more robust wrt adding new SIMD types.

BUG=

Review URL: https://codereview.chromium.org/1286313003

Cr-Commit-Position: refs/heads/master@{#30241}

The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.

R=littledan@chromium.org
LOG=N
BUG=v8:4218

Review URL: https://codereview.chromium.org/1237583005

Cr-Commit-Position: refs/heads/master@{#30240}

Use macros for SIMD get/set_lane, and print fns.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1302513004

Cr-Commit-Position: refs/heads/master@{#30239}

BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1290683004 .

Cr-Commit-Position: refs/heads/master@{#30238}

TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1295323003 .

Cr-Commit-Position: refs/heads/master@{#30237}

Adding wasm=on when invoking make will build with the wasm prototype, Ex:

make x64.debug wasm=on V=1

BUG=None
TEST=manual
R=titzer@chromium.org,ncbray@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1293073004

Cr-Commit-Position: refs/heads/master@{#30236}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1299023002

Cr-Commit-Position: refs/heads/master@{#30235}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1295333002

Cr-Commit-Position: refs/heads/master@{#30234}

Seems to fail only on V8 Linux - debug - code serializer
(See http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20code%20serializer/builds/3762)

BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1294163003 .

Cr-Commit-Position: refs/heads/master@{#30233}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1293053004

Cr-Commit-Position: refs/heads/master@{#30232}

TBR=adamk@chromium.org

Review URL: https://codereview.chromium.org/1302593002 .

Cr-Commit-Position: refs/heads/master@{#30231}

BUG=chromium:518748
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1284683004

Cr-Commit-Position: refs/heads/master@{#30230}

Don't use exit(), use Shell::Exit() (which calls _exit() instead). This won't
run C++ static destructors, atexit() functions, etc., which can occasionally
cause flaky failures.

BUG=v8:4279
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1294913005

Cr-Commit-Position: refs/heads/master@{#30229}

This warns about include directives of inline headers within normal
header files. Note that this warning should not close the tree or
prevent the CQ from landing the patch.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1293273005

Cr-Commit-Position: refs/heads/master@{#30228}

This CL us a pure refactoring that makes an empty compilation unit
including just "heap.h" but not "objects-inl.h" compile without
warnings or errors. This is needed to further reduce the header
dependency tangle.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1301583003

Cr-Commit-Position: refs/heads/master@{#30227}

Adds implementations and tests for the following bytecodes:
  - LdaZero
  - LdaSmi8
  - LdaUndefined
  - LdaNull
  - LdaTheHole
  - LdaTrue
  - LdaFalse
  - LdaLdar
  - LdaStar

Also adds  Smi tagging / untagging and OperandType typed
BytecodeOperand operations to InterpreterAssembler.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1294793002

Cr-Commit-Position: refs/heads/master@{#30226}

Place a copy of the v8-native-prototype in third_party/wasm.
GYP_DEFINES='v8_wasm=1' gclient runhooks

BUG=None
TEST=None
R=titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1294543006

Cr-Commit-Position: refs/heads/master@{#30225}

Previously, it was not possible to specify StackSlotOperands for all
slots in both the caller and callee stacks. Specifically, the region
of the callee's stack including the saved return address, frame
pointer, function pointer and context pointer could not be addressed
by the register allocator/gap resolver.

In preparation for better tail call support, which will use the gap
resolver to reconcile outgoing parameters, this change makes it
possible to address all slots on the stack, because slots in the
previously inaccessible dead zone may become parameter slots for
outgoing tail calls. All caller stack slots are accessible as they
were before, with slot -1 corresponding to the last stack
parameter. Stack slot indices >= 0 access the callee stack, with slot
0 corresponding to the callee's saved return address, 1 corresponding
to the saved frame pointer, 2 corresponding to the current function
context, 3 corresponding to the frame marker/JSFunction, and slots 4
and above corresponding to spill slots.

The following changes were specifically	needed:

* Frame	has been changed to explicitly manage three areas of the
  callee frame, the fixed header, the spill slot area, and the
  callee-saved register area.
* Conversions from stack slot indices to fp offsets all now go through
  a common bottleneck: OptimizedFrame::StackSlotOffsetRelativeToFp
* The generation of deoptimization translation tables has been changed
  to support the new stack slot indexing scheme. Crankshaft, which
  doesn't support the new slot numbering in its register allocator,
  must adapt the indexes when creating translation tables.
* Callee-saved parameters are now kept below spill slots, not above,
  to support saving only the optimal set of used registers, which is
  only known after register allocation is finished and spill slots
  have been allocated.

Review URL: https://codereview.chromium.org/1261923007

Cr-Commit-Position: refs/heads/master@{#30224}

R=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1290383004

Cr-Commit-Position: refs/heads/master@{#30223}

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1303463002

Cr-Commit-Position: refs/heads/master@{#30222}

Bytecode generator for local assignment and basic binary operations.

Command-line flag for printing bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1294543002

Cr-Commit-Position: refs/heads/master@{#30221}

%InstallFunctionsFromArray is not entirely equivalent to the old
InstallFunctions implementation, which causes gc stress failures.

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1287203006

Cr-Commit-Position: refs/heads/master@{#30220}

Makes the following modifications to the interpreter builtins and
InterpreterAssembler:
 - Adds an accumulator register and initializes it to undefined()
 - Adds a register file pointer register and use it instead of FramePointer to
   access registers
 - Modifies builtin to support functions with 0 regiters in the register file
 - Modifies builtin to Call rather than TailCall to first bytecode handler.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1289863003

Cr-Commit-Position: refs/heads/master@{#30219}

* Add types to properly report what has been executed in the GC
* Unify GCPrologueCallback and GCEpilogueCallback into GCCallback
* Report processing of second round weak handels, either synchronously or asynchronously

BUG=chromium:521946
LOG=N

Review URL: https://codereview.chromium.org/1298113003

Cr-Commit-Position: refs/heads/master@{#30218}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1294803004

Cr-Commit-Position: refs/heads/master@{#30217}

TBR=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1295813006

Cr-Commit-Position: refs/heads/master@{#30216}

Reland of move property loads from js builtins objects from runtime. (patchset #1 id:1 of https://codereview.chromium.org/1297803003/ )

Reason for revert:
Debug isolate failure has nothing to do with this CL.

Original issue's description:
> Revert of Remove property loads from js builtins objects from runtime. (patchset #2 id:20001 of https://codereview.chromium.org/1293113002/ )
>
> Reason for revert:
> Still failures in debug-isolates tests
>
> Original issue's description:
> > Remove property loads from js builtins objects from runtime.
> >
> > R=cbruni@chromium.org
> >
> > Committed: https://crrev.com/40f6e80d22d2e146b781aa661b76087ab9a492c4
> > Cr-Commit-Position: refs/heads/master@{#30199}
> >
> > Committed: https://crrev.com/f22d0f205031054a5f3116e052c81ae85741e8e0
> > Cr-Commit-Position: refs/heads/master@{#30209}
>
> TBR=cbruni@chromium.org,hpayer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/4106a4cbb701b5fe7d0b639e28a4ebfca5c05630
> Cr-Commit-Position: refs/heads/master@{#30213}

TBR=cbruni@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1298733003

Cr-Commit-Position: refs/heads/master@{#30215}

Adding missing rd register in JALR disassembly, for mips and mipps64

Review URL: https://codereview.chromium.org/1297183002

Cr-Commit-Position: refs/heads/master@{#30214}

Revert of Remove property loads from js builtins objects from runtime. (patchset #2 id:20001 of https://codereview.chromium.org/1293113002/ )

Reason for revert:
Still failures in debug-isolates tests

Original issue's description:
> Remove property loads from js builtins objects from runtime.
>
> R=cbruni@chromium.org
>
> Committed: https://crrev.com/40f6e80d22d2e146b781aa661b76087ab9a492c4
> Cr-Commit-Position: refs/heads/master@{#30199}
>
> Committed: https://crrev.com/f22d0f205031054a5f3116e052c81ae85741e8e0
> Cr-Commit-Position: refs/heads/master@{#30209}

TBR=cbruni@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1297803003

Cr-Commit-Position: refs/heads/master@{#30213}