R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133303006

Cr-Commit-Position: refs/heads/master@{#28392}

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1138153003

Cr-Commit-Position: refs/heads/master@{#28391}

port bd56d279 (R28340).

original commit message:

    Make the parser handle references to "this" as unresolved variables, so the
    same logic as for the rest of function parameters is used for the receiver.
    Minor additions to the code generation handle copying the receiver to the
    context, along with the rest of the function parameters.

    Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=

Review URL: https://codereview.chromium.org/1136953010

Cr-Commit-Position: refs/heads/master@{#28390}

This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}

port 3bce9c3a (r28359).

original commit message:

    HMaybeGrowElements moves the situation where you actually have to grow
    into deferred code. This means crankshaft doesn't have to spill registers
    just to make the bounds comparison to see if it'll need to grow or not.

    It makes the growing case a bit more expensive, but reduces the cost of
    the general case.

BUG=

Review URL: https://codereview.chromium.org/1124093008

Cr-Commit-Position: refs/heads/master@{#28388}

port 3226e980 (28346).

original commit message:

    [strong] Check arity of functions

    In strong mode it is an error to call a function with too few
    arguments.

    This is enforced inside the ArgumentsAdaptorTrampoline.

    This does not yet handle rest parameter

BUG=

Review URL: https://codereview.chromium.org/1139913007

Cr-Commit-Position: refs/heads/master@{#28387}

port  abc35080 (r28339)

original commit message:

    This stub will be used as the basis of a Math.floor-specific CallIC to
    detect and track calls to floor that return -0.

    Along the way:
    - Create a TurboFanCodeStub super class from which the StringLength and
    MathRound TF stubs derive.
    - Fix the ugly hack that passes the first stub parameter as the "this"
    pointer in the the TF-compiled JS function.
    - Fix bugs in the ia32/x64 disassembler.

BUG=

Review URL: https://codereview.chromium.org/1134323002

Cr-Commit-Position: refs/heads/master@{#28386}

We keep an eye on the recursion depth. Once it exceeds a limit, we serialize
only the object header and size, but defer serializing the object body for
after we have unwound the stack.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1125073004

Cr-Commit-Position: refs/heads/master@{#28385}

TEST=tools/run_perf.py --arch x64 --extra-flags="--turbo --turbo-verify-allocation --turbo-greedy-regalloc" /path/to/SunSpider.json
BUG=484208
LOG=n
TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1128933007

Cr-Commit-Position: refs/heads/master@{#28384}

Use these check points to optimize comparisons where we already know
that one side cannot be a String (or turn into a string via
ToPrimitive).

Also remove bunch of useless DoNotCrash tests for the scheduler that are
painful to maintain and add almost no value.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140583004

Cr-Commit-Position: refs/heads/master@{#28383}

This patch adds three methods to TypedArrays which are already
implemented for arrays. The implementations are made by calling
out to the underlying code used by Arrays.

R=adamk@chromium.org
BUG=v8:3578
LOG=Y

Review URL: https://codereview.chromium.org/1136663005

Cr-Commit-Position: refs/heads/master@{#28382}

This patch adds the copyWithin method to TypedArrays. For the first
pass, the internals of Array.copyWithin are used. Eventually, a more
efficient form based on memcpy could be used instead.

BUG=v8:3578
LOG=Y
R=adamk@chromium.org, arv@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/1131113002

Cr-Commit-Position: refs/heads/master@{#28381}

TBR=arv@chromium.org

Review URL: https://codereview.chromium.org/1129713004

Cr-Commit-Position: refs/heads/master@{#28380}

This is a follow up to https://codereview.chromium.org/1115263004/

BUG=v8:3956
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1141603002

Cr-Commit-Position: refs/heads/master@{#28379}

BUG=chromium:486005
LOG=NO

Review URL: https://codereview.chromium.org/1131943004

Cr-Commit-Position: refs/heads/master@{#28378}

R=arv@chromium.org,verwaest@chromium.org
BUG=v8:4097
LOG=N

Review URL: https://codereview.chromium.org/1132203005

Cr-Commit-Position: refs/heads/master@{#28377}

BUG=

Review URL: https://codereview.chromium.org/1132493006

Cr-Commit-Position: refs/heads/master@{#28376}

Do not trash type register in kIsNotStringMask test.

R=conradw@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1124333013

Cr-Commit-Position: refs/heads/master@{#28375}

Fix build break.

R=conradw@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1130603004

Cr-Commit-Position: refs/heads/master@{#28374}

BUG=

Review URL: https://codereview.chromium.org/1138493004

Cr-Commit-Position: refs/heads/master@{#28373}

Port 3bce9c3a

Original commit message:
HMaybeGrowElements moves the situation where you actually have to grow
into deferred code. This means crankshaft doesn't have to spill registers
just to make the bounds comparison to see if it'll need to grow or not.

It makes the growing case a bit more expensive, but reduces the cost of
the general case.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1132743004

Cr-Commit-Position: refs/heads/master@{#28372}

Some of the DevTools' clients need to inspect JS objects without enabling debugger. This CL allows to inspect object's internal properties without enabling debugger and instantiating debug context.

Note that now debug context can be created lazily if v8::Debug::GetDebugContext is called when there is no debug listener. This is fragile and has already resulted in some subtle error. I'm going to fix that in a separate CL.

BUG=chromium:481845
LOG=Y

Review URL: https://codereview.chromium.org/1134193002

Cr-Commit-Position: refs/heads/master@{#28371}

Implements the strong mode proposal's restrictions on implicit conversions
for the binary >, >=, <, and <= operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1130283002

Cr-Commit-Position: refs/heads/master@{#28370}

Mark internal AccessorInfo properties as "special data properties" to ensure correct strict-mode handling.

BUG=

Review URL: https://codereview.chromium.org/1123163005

Cr-Commit-Position: refs/heads/master@{#28369}

NOTRY=true
NOTREECHECKS=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1137143003

Cr-Commit-Position: refs/heads/master@{#28368}

Review URL: https://codereview.chromium.org/1138173002

Cr-Commit-Position: refs/heads/master@{#28367}

R=mvstanton@chromium.org

Committed: https://crrev.com/8608e619afe2b4514b0577bfb73a153b1550d41f
Cr-Commit-Position: refs/heads/master@{#28357}

Review URL: https://codereview.chromium.org/1126043004

Cr-Commit-Position: refs/heads/master@{#28366}

Revert of Provide accessor for object internal properties that doesn't require debugger to be active (patchset #3 id:40001 of https://codereview.chromium.org/1126103006/)

Reason for revert:
GC mole issues: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gcmole/builds/1950/steps/GCMole%20ia32/logs/stdio

Original issue's description:
> Provide accessor for object internal properties that doesn't require debugger to be active
>
> Some of the DevTools' clients need to inspect JS objects without enabling debugger. This CL allows to inspect object's internal properties without enabling debugger and instantiating debug context.
>
> Note that now debug context can be created lazily if v8::Debug::GetDebugContext is called when there is no debug listener. This is fragile and has already resulted in some subtle error. I'm going to fix that in a separate CL.
>
> BUG=chromium:481845
> LOG=Y
>
> Committed: https://crrev.com/bdeb0de88c8cf5f2c78f261b45314138f525110d
> Cr-Commit-Position: refs/heads/master@{#28362}

TBR=pfeldman@chromium.org,kozyatinskiy@chromium.org,yurys@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:481845

Review URL: https://codereview.chromium.org/1133243002

Cr-Commit-Position: refs/heads/master@{#28365}

Handle missing or improper FrameStates more gracefully.
Uses the operator properties to determine if the node contains a FrameState
before, then checks if a valid bailout id exists.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1135243002

Cr-Commit-Position: refs/heads/master@{#28364}

[turbofan] Add AdvancedReducer::ReplaceWithValue() method and convert JSInlining to an AdvancedReducer.

Note that this is just a duplication for now. We'll want to get rid of the
NodeProperties::ReplaceWithValue() method in the long run.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1135483004

Cr-Commit-Position: refs/heads/master@{#28363}

Some of the DevTools' clients need to inspect JS objects without enabling debugger. This CL allows to inspect object's internal properties without enabling debugger and instantiating debug context.

Note that now debug context can be created lazily if v8::Debug::GetDebugContext is called when there is no debug listener. This is fragile and has already resulted in some subtle error. I'm going to fix that in a separate CL.

BUG=chromium:481845
LOG=Y

Review URL: https://codereview.chromium.org/1126103006

Cr-Commit-Position: refs/heads/master@{#28362}

[turbofan] Use FrameStatesBeforeAndAfter to simplify handling of before/after frame states in AstGraphBuilder.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1128193005

Cr-Commit-Position: refs/heads/master@{#28361}

In follow-up CLs the scavenger and the MC collector should also respect the unalignment of heap numbers.

BUG=

Review URL: https://codereview.chromium.org/1141523002

Cr-Commit-Position: refs/heads/master@{#28360}

HMaybeGrowElements moves the situation where you actually have to grow
into deferred code. This means crankshaft doesn't have to spill registers
just to make the bounds comparison to see if it'll need to grow or not.

It makes the growing case a bit more expensive, but reduces the cost of
the general case.

BUG=chromium:484025
LOG=N

Review URL: https://codereview.chromium.org/1124443004

Cr-Commit-Position: refs/heads/master@{#28359}

Revert of Migrate error messages, part 10. (patchset #2 id:20001 of https://codereview.chromium.org/1126043004/)

Reason for revert:
patch didn't apply correctly.

Original issue's description:
> Migrate error messages, part 10.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/8608e619afe2b4514b0577bfb73a153b1550d41f
> Cr-Commit-Position: refs/heads/master@{#28357}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1130073005

Cr-Commit-Position: refs/heads/master@{#28358}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1126043004

Cr-Commit-Position: refs/heads/master@{#28357}

If there had been no debug listener v8::Debug::GetDebugContext would have created new context and wouln't have kept reference to it. This way we may well end up with several debug contexts and disabled debugger.

As a side effect this change allows to efficiently distinguish debug context from blink contexts by simply comparing handles.

BUG=chromium:482290
LOG=Y

Review URL: https://codereview.chromium.org/1136733002

Cr-Commit-Position: refs/heads/master@{#28356}

Revert of Use function wrapper argument to expose internal arrays to native scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1127983003/)

Reason for revert:
custom snapshot builder failing.

Original issue's description:
> Use function wrapper argument to expose internal arrays to native scripts.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/a9b5a1795449d94387218d25baed2c2b3c4fbadc
> Cr-Commit-Position: refs/heads/master@{#28354}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1123353008

Cr-Commit-Position: refs/heads/master@{#28355}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1127983003

Cr-Commit-Position: refs/heads/master@{#28354}

Embedders need to always pass CreateParams now

BUG=none
LOG=y
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1133723004

Cr-Commit-Position: refs/heads/master@{#28353}