This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}

The problem is that the gc pattern is different, and the list of debug scripts
may have more or less duplicates than before. The solution is to just turn off
--stress-opt for the test.

R=yangguo@chromium.org
BUG=v8:4502
LOG=N

Review URL: https://codereview.chromium.org/1416883002

Cr-Commit-Position: refs/heads/master@{#31415}

BUG=chromium:534746
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1410333004

Cr-Commit-Position: refs/heads/master@{#31414}

For now, only rewire builtins in v8natives.js to call the new runtime functions.

Review URL: https://codereview.chromium.org/1409613004

Cr-Commit-Position: refs/heads/master@{#31413}

R=bmeurer@chromium.org
TEST=mjsunit/harmony/reflect --exhaustive-variants
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414263002

Cr-Commit-Position: refs/heads/master@{#31412}

Use the simple inline function version of {Min, Max} where possible to
improve performance

Now uses an forced inline js function instead of a python macro
to avoid expressions be evaluated twice

Follow-up to CR: https://codereview.chromium.org/1331993004

Review URL: https://codereview.chromium.org/1410473002

Cr-Commit-Position: refs/heads/master@{#31411}

Review URL: https://codereview.chromium.org/1405363003

Cr-Commit-Position: refs/heads/master@{#31410}

Review URL: https://codereview.chromium.org/1402353006

Cr-Commit-Position: refs/heads/master@{#31409}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1417583003

Cr-Commit-Position: refs/heads/master@{#31408}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1416863002 .

Cr-Commit-Position: refs/heads/master@{#31407}

This stages the general purpose inlining mechanism in TurboFan and
also disables the remaining tests that still fail. We do this to get
test coverage early and to avoid regressing inlining as we go along.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419623002

Cr-Commit-Position: refs/heads/master@{#31406}

This fixes JSNativeContextSpecialization to not lower JSLoadGlobal and
JSStoreGlobal nodes if the global variable has morphed into a context
variable that is currently within a TDZ. Scary variable binding is being
scary!

R=bmeurer@chromium.org
TEST=cctest/test-decls/Regress3941 --turbo-filter="f"
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1415733003

Cr-Commit-Position: refs/heads/master@{#31405}

Revert of [es6] Fix scoping for default parameters in arrow functions (patchset #5 id:80001 of https://codereview.chromium.org/1405313002/ )

Reason for revert:
Breaks nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2407/steps/Check/logs/regress-4395

Original issue's description:
> [es6] Fix scoping for default parameters in arrow functions
>
> When eagerly parsing arrow functions, expressions in default
> parameter initializers are parsed in the enclosing scope,
> rather than in the function's scope (since that scope does not
> yet exist). This leads to VariableProxies being added to the
> wrong scope, and scope chains for FunctionLiterals being incorrect.
>
> This patch addresses these problems by adding a subclass of
> AstExpressionVisitor that moves VariableProxies to the proper
> scope and fixes up scope chains of FunctionLiterals.
>
> More work likely still needs to be done to make this work completely,
> but it's very close to correct.
>
> BUG=v8:4395
> LOG=y
>
> Committed: https://crrev.com/cf72aad39e51de9b7074ea039377c1812f4a2c6b
> Cr-Commit-Position: refs/heads/master@{#31402}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4395

Review URL: https://codereview.chromium.org/1417463004

Cr-Commit-Position: refs/heads/master@{#31404}

This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}

When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1405313002

Cr-Commit-Position: refs/heads/master@{#31402}

We need to use the ReturnId for calls, otherwise lazy bailout will not
work correctly in case of inlining.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407953004

Cr-Commit-Position: refs/heads/master@{#31401}

BUG=chromium:544774
LOG=n

Review URL: https://codereview.chromium.org/1409023004

Cr-Commit-Position: refs/heads/master@{#31400}

This fixes the bailout point used by JSCreateScriptContext nodes for
top-level code. The bailout point differs from the Crankshaft one as
parameter slots have not been copied and the context chain was not
extended yet in TurboFan. Hence a new bailout id is required.

R=ishell@chromium.org
TEST=cctest/test-decls/CrossScript --turbo-inlining

Review URL: https://codereview.chromium.org/1413933005

Cr-Commit-Position: refs/heads/master@{#31399}

Revert of [es6] stage sticky regexps and RegExp.prototype.flags. (patchset #3 id:40001 of https://codereview.chromium.org/1412133002/ )

Reason for revert:
[sheriff] breaks nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/4816

Original issue's description:
> [es6] stage sticky regexps and RegExp.prototype.flags.
>
> R=littledan@chromium.org
> BUG=v8:4342
> LOG=Y
>
> Committed: https://crrev.com/722719fe31fe7fd5bb50be6256b3581bb28a8169
> Cr-Commit-Position: refs/heads/master@{#31390}

TBR=littledan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4342

Review URL: https://codereview.chromium.org/1403283004

Cr-Commit-Position: refs/heads/master@{#31398}

BUG=

Review URL: https://codereview.chromium.org/1410713006

Cr-Commit-Position: refs/heads/master@{#31397}

NOTRY=true
TBR=mbrandy@us.ibm.com

Review URL: https://codereview.chromium.org/1411993004

Cr-Commit-Position: refs/heads/master@{#31396}

The boards on the bots do not have FPU, and therefore time out on
this test.

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1411313003

Cr-Commit-Position: refs/heads/master@{#31395}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1415463004

Cr-Commit-Position: refs/heads/master@{#31394}

Revert "[turbofan] Stage --turbo-inlining behind --turbo flag." and "[turbofan] Skip more tests that fail with --turbo-inlining."

This reverts commit 019f9408,
6ed05f44 and
e34c343d.

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1413183004 .

Cr-Commit-Position: refs/heads/master@{#31393}

The debugger calls PromiseHasUserDefinedRejectHandler to recursively search the
tree of dependent promises for user-defined reject handlers. If no such reject
handler exists, rejecting the promise is considered an uncaught exception.

Promise.race and Promise.all interupt the link of promise dependency wrt the
search. This change fixes that link.

R=rossberg@chromium.org
BUG=chromium:439585
LOG=N

Review URL: https://codereview.chromium.org/1411083003

Cr-Commit-Position: refs/heads/master@{#31392}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1416663004

Cr-Commit-Position: refs/heads/master@{#31391}

R=littledan@chromium.org
BUG=v8:4342
LOG=Y

Review URL: https://codereview.chromium.org/1412133002

Cr-Commit-Position: refs/heads/master@{#31390}

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414173002 .

Cr-Commit-Position: refs/heads/master@{#31389}

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1415843002 .

Cr-Commit-Position: refs/heads/master@{#31388}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1406963004

Cr-Commit-Position: refs/heads/master@{#31387}

This stages the general purpose inlining mechanism in TurboFan and also
disables the remaining tests that still fail. We do this to get test
coverage early and to avoid regressing inlining as we go along.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412703002

Cr-Commit-Position: refs/heads/master@{#31386}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413183002

Cr-Commit-Position: refs/heads/master@{#31385}

Port e678a0f9

Original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412153003

Cr-Commit-Position: refs/heads/master@{#31384}

During eviction of FreeSpace nodes that reside on eviction pages we iterate
throug the list node-by-node, unlinking only those that reside on eviction
pages. We failed to properly update end_ if nodes were evicted are encountering
nodes that that are left as is.

BUG=chromium:539356
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411263002

Cr-Commit-Position: refs/heads/master@{#31383}

BUG=v8:1306
LOG=Y

Review URL: https://codereview.chromium.org/1411053002

Cr-Commit-Position: refs/heads/master@{#31382}

Re-land of https://crrev.com/cf13dda1ba25e8293ea143f33c6c5f6233a39c86,
fixing the issue with vector stores.

Class methods always have the class scope on their scope chain in order
to implement strong mode checks. Previously, that scope wasn't attached
to the ClassLiteral for anonymous classes (since the scope contained
no bindings).

This patch simply puts that same scope on the ClassLiteral, anonymous
or not, which simplifies other code that needs to reason about the scope
of a class and its methods.

Review URL: https://codereview.chromium.org/1418433002

Cr-Commit-Position: refs/heads/master@{#31381}

This is exactly what it looks like. A temporary hack that ensures we
can make forward progress with the JSInliner despite other components
have a hard time picking the correct zone. This hack is a hack!

R=bmeurer@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1410963003

Cr-Commit-Position: refs/heads/master@{#31380}

Should already work according to issue.

BUG=chromium:424619
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1413913002

Cr-Commit-Position: refs/heads/master@{#31379}

Separately collect element keys from property keys to avoid slow
corner-cases. Partly deal with keys generated by Proxies.

BUG=chromium:536790
LOG=N

Review URL: https://codereview.chromium.org/1397063002

Cr-Commit-Position: refs/heads/master@{#31378}

This adds a test case that ensures calling Debug.scripts without any
listener attached fails gracefully. For now we are throwing the string
"illegal access", this might change in the future to be a dedicated
exception.

R=yangguo@chromium.org
TEST=mjsunit/debug-scripts-throw

Review URL: https://codereview.chromium.org/1411193002

Cr-Commit-Position: refs/heads/master@{#31377}