Port 322ffda3

Original commit message:
    Also migrate the Number constructor to a native builtin, using the
    same mechanism already used by the String constructor. Otherwise just
    parsing and compiling the Number constructor to optimized code already
    eats 2ms on desktop for no good reason, and the resulting optimized
    code is not even close to awesome.

    Drive-by-fix: Use correct context for the [[Construct]] case of the
    String constructor as well, and share some code with it.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583903002

Cr-Commit-Position: refs/heads/master@{#33272}

exception operand in a handler block. This avoids confusing
unrelated ranges, which may happen if escape analysis elides
the exception operand.

BUG=chromium:576195
LOG=N

Review URL: https://codereview.chromium.org/1579603005

Cr-Commit-Position: refs/heads/master@{#33271}

The escape analysis transformation phase visits allocation nodes
twice under some circumstances, thus reporting wrong counter values.
This CL ensures counter values are correct.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1577273002

Cr-Commit-Position: refs/heads/master@{#33270}

Removes assignment hazard scope. Reverts back to the naive scheme of
allocating a temporary for every variable load. It was decided to revert it
because the current implementation does not handle logical expressions,
ternary operators, visiting objects in named/keyed loads. Also, we wanted
to evaluate alternate approaches and choose one when we have a mechanism
to measure performance.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1576403004

Cr-Commit-Position: refs/heads/master@{#33269}

Once we use type feedback, we need to reflect the feedback in the types, propagate
the new narrower types forward and use them in the subsequent
representation inference. This CL propagates and uses the recomputed types
for Phi and Select nodes (rather than using the types from the typer).

Review URL: https://codereview.chromium.org/1580353003

Cr-Commit-Position: refs/heads/master@{#33268}

This bug improves performance of escape analysis.

* A allocation discovery phase  (EscapeAnalysis::AssignAliases)
  ensures compact representation of virtual state
* Node revisiting in EscapeStatusAnalysis has been improved
* Escape analysis no longer requires a trimmed graph

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1559123003

Cr-Commit-Position: refs/heads/master@{#33267}

Port 5091e8f2

TEST=cctest/test-assembler-mips64/jump_tables1,cctest/test-assembler-mips64/jump_tables2,cctest/test-assembler-mips64/jump_tables3,cctest/test-macro-assembler-mips/jump_tables5
BUG=

Review URL: https://codereview.chromium.org/1582533005

Cr-Commit-Position: refs/heads/master@{#33266}

Also migrate the Number constructor to a native builtin, using the
same mechanism already used by the String constructor. Otherwise just
parsing and compiling the Number constructor to optimized code already
eats 2ms on desktop for no good reason, and the resulting optimized
code is not even close to awesome.

Drive-by-fix: Use correct context for the [[Construct]] case of the
String constructor as well, and share some code with it.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1573243009

Cr-Commit-Position: refs/heads/master@{#33265}

Code copied 1:1 from chromium.

BUG=chromium:565952
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1580193004

Cr-Commit-Position: refs/heads/master@{#33264}

This uses the bots introduced here:
https://codereview.chromium.org/1581803003/

BUG=chromium:535160
LOG=n
NOTRY=true
NOPRESUBMIT=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1588543002

Cr-Commit-Position: refs/heads/master@{#33263}

ReportFailedAccessCheck() sometimes doesn't throw an exception (it's up
to the embedder). Pretend that OrdinaryDefineOwnProperty() succeeded in
that case. This is consistent with existing behavior of other methods:
- JSObject::DefineOwnPropertyIgnoreAttributes
- JSObject::SetPropertyWithFailedAccessCheck
- Object::SetPropertyWithAccessor

See also commit f66c3f5c.

BUG=chromium:574217
LOG=n
R=neis@chromium.org

Review URL: https://codereview.chromium.org/1580823002

Cr-Commit-Position: refs/heads/master@{#33262}

R=jarin@chromium.org
BUG=v8:4650
LOG=Y

Review URL: https://codereview.chromium.org/1574113009

Cr-Commit-Position: refs/heads/master@{#33261}

(fast_handler *has* a more specific type; the TODO is no longer applicable.)

R=epertoso@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1577233003

Cr-Commit-Position: refs/heads/master@{#33260}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1587483003

Cr-Commit-Position: refs/heads/master@{#33259}

The API functions are always in sloppy mode, so receiver is always a
JSReceiver once the actual call trampoline runs, no need to check again
in various places.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1575973006

Cr-Commit-Position: refs/heads/master@{#33258}

Rolling v8/tools/clang to afad7aa23b146a86be9bc335caaac5bcfa72f390

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1584673002

Cr-Commit-Position: refs/heads/master@{#33257}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1583603002

Cr-Commit-Position: refs/heads/master@{#33256}

Review URL: https://codereview.chromium.org/1580123002

Cr-Commit-Position: refs/heads/master@{#33255}

http://tc39.github.io/ecma262/#sec-destructuring-assignment-static-semantics-early-errors
requires that DestructuringAssignmentTargets which do not match Pattern productions,
must return true for IsValidSimpleAssignmentTarget.

This change rejects parenthesized patterns with a SyntaxError.

BUG=v8:4662, v8:811
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, nikolaos@chromium.org

Review URL: https://codereview.chromium.org/1585473002

Cr-Commit-Position: refs/heads/master@{#33254}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1584573002

Cr-Commit-Position: refs/heads/master@{#33253}

Failing to do so results in out-of-date marking information, because live bytes
is not properly adjusted.

This CL adds support for right trimming ByteArray and properly DCHECKs that we
do not left trim  ByteArray (as we already do for FixedTypedArrayBase).

BUG=

Review URL: https://codereview.chromium.org/1577263003

Cr-Commit-Position: refs/heads/master@{#33252}

R=ahaas@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575167

Review URL: https://codereview.chromium.org/1577803002

Cr-Commit-Position: refs/heads/master@{#33251}

BUG=v8:4661, v8:4488
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1575133003

Cr-Commit-Position: refs/heads/master@{#33250}

BUG=

Review URL: https://codereview.chromium.org/1573953002

Cr-Commit-Position: refs/heads/master@{#33249}

No functional change.  This is prep for fixing test failures in wasm tests.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583523002

Cr-Commit-Position: refs/heads/master@{#33248}

NOTRY=true
TBR=rmcilroy@chromium.org, neis@chromium.org

Review URL: https://codereview.chromium.org/1574343002

Cr-Commit-Position: refs/heads/master@{#33247}

The hash calculation was dependent on upper part of |inner_pointer| and caused non-deterministic cache miss events which in turn caused non-deterministic progress of pages sweeping (see GcSafeFindCodeForInnerPointer()).

Review URL: https://codereview.chromium.org/1582573002

Cr-Commit-Position: refs/heads/master@{#33246}

There's no need to mark these as possibly-direct-eval, since all such an
eval-tagged string will ever get passed is the array of string parts, which
will be immediately returns (since it's not a string). It will
never do a lookup in the current scope, nor (in sloppy mode) introduce
new declarations.

This patch is not intended to change behavior, but I've added tests that
demonstrate the stuff explained in the preceding paragraph.

Review URL: https://codereview.chromium.org/1580463003

Cr-Commit-Position: refs/heads/master@{#33245}

Failing chromium layout tests were marked for rebaselining.

Addition to original CL (https://codereview.chromium.org/1580693002/):
Skip some more ignition tests.

BUG=v8:3931,v8:1543
LOG=Y
R=hablich@chromium.org
CC=verwaest@chromium.org, rossberg@chromium.org,rmcilroy, oth

Review URL: https://codereview.chromium.org/1580783002

Cr-Commit-Position: refs/heads/master@{#33244}

This fixes a number of crashes where other code was assuming there would
be at least one deopt point in all optimized functions (i.e., the
StackCheck) but we weren't producing any.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1572333002

Cr-Commit-Position: refs/heads/master@{#33243}

No need to distribute the setup of the Function global property across
three different places, instead do everything in a single place during
bootstrapping.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1577703005

Cr-Commit-Position: refs/heads/master@{#33242}

That will allow for adding private symbols to JSProxies in a follow-up
change

BUG=chromium:571365
R=neis@chromium.org,verwaest@chromium.org,rossberg@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1575423002

Cr-Commit-Position: refs/heads/master@{#33241}

R=verwaest@chromium.org
BUG=chromium:576662,v8:1543
LOG=y

Review URL: https://codereview.chromium.org/1580723003

Cr-Commit-Position: refs/heads/master@{#33240}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:576560

Review URL: https://codereview.chromium.org/1574063005

Cr-Commit-Position: refs/heads/master@{#33239}

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1574263002

Cr-Commit-Position: refs/heads/master@{#33238}

Adds support for LOOKUP_SLOT_CALL calls to the interpreter. Also changes
VisitCall to keep callee and reciever consecutive to avoid register
shuffles when performing LOOKUP_SLOT_CALL calls. Adds tests for the
interpreter and bytecode graph generator.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568323002

Cr-Commit-Position: refs/heads/master@{#33237}

Revert of [Proxies] Ship Proxies + Reflect (patchset #2 id:20001 of https://codereview.chromium.org/1580693002/ )

Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream first.

https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/3587
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3873

Original issue's description:
> [Proxies] Ship Proxies + Reflect
>
> BUG=v8:3931,v8:1543
> LOG=Y
> R=verwaest@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/9ce5162fd2a36daf318e0ec3838cd90f4e179168
> Cr-Commit-Position: refs/heads/master@{#33234}

TBR=rossberg@chromium.org,verwaest@chromium.org,hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3931,v8:1543

Review URL: https://codereview.chromium.org/1579573004

Cr-Commit-Position: refs/heads/master@{#33236}

- Simplify the variable-length pop sequence on entry. (It now uses
  smaller code with no branches.)
- Use conditional compare to merge branches where appropriate.
- Make use of Ldrsw + UntagSmiFieldMemOperand to load smis more
  efficiently.
- Only load 'undefined' and 'null' once per builtin.
- A few other small improvements.

BUG=

Review URL: https://codereview.chromium.org/1576403002

Cr-Commit-Position: refs/heads/master@{#33235}

BUG=v8:3931,v8:1543
LOG=Y
R=verwaest@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1580693002

Cr-Commit-Position: refs/heads/master@{#33234}

We use a scratchpad to remember visited allocation sites for post processing
(making tenure decisions). The previous implementation used a rooted FixedArray
with constant length (256) to remember all sites. Updating the scratchpad is a
bottleneck in any parallel/concurrent implementation of newspace evacuation.

The new implementation uses a HashMap with allocation sites as keys and
temporary counts as values. During evacuation we collect a local hashmap of
visited allocation sites. Upon merging the local hashmap back into a global one
we update potential forward pointers of compacted allocation sites.  The
scavenger can directly enter its entries into the global hashmap. Note that the
actual memento found count is still kept on the AllocationSite as it needs to
survive scavenges and full GCs.

BUG=chromium:524425
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1535723002

Cr-Commit-Position: refs/heads/master@{#33233}