Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
(this caused a test262 failure.). However, the code `eval("function NaN() {}");`
should actually throw a TypeError. This patch changes most cases of
redeclaration errors from TypeError to SyntaxError. See the test
mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
references.

The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
ES#sec-evaldeclarationinstantiation

BUG=v8:4955
LOG=y

Review-Url: https://codereview.chromium.org/2048703002
Cr-Commit-Position: refs/heads/master@{#36940}

This patch declares a new rest parameter for the derived constructor,
and passes it to base constructor after calling PrepareSpreadArguments.

This patch also updates the test262.status to account for
the now passing test.

BUG=v8:4890

Review-Url: https://codereview.chromium.org/2056993004
Cr-Commit-Position: refs/heads/master@{#36939}

BUG=v8:4483, v8:4907, 618603
LOG=N
R=neis@chromium.org, yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2051423003
Cr-Commit-Position: refs/heads/master@{#36938}

With cl https://codereview.chromium.org/2043033002 blink will add new wrappers
to its marking deque (and maintain this deque) so black allocated wrappers are
not a problem anymore. To limit the scope of when blink has to detect wrappers,
we need to tell blink when we start and when we end full gcs. For that we can
nicely use TracePrologue and TraceEpilogue.

LOG=no
BUG=468240

Review-Url: https://codereview.chromium.org/2051103002
Cr-Commit-Position: refs/heads/master@{#36937}

* The default text (placeholder) in the search box is now present.
* All key events handled by turbolizer are not passed through to Chrome.

Review-Url: https://codereview.chromium.org/2061713002
Cr-Commit-Position: refs/heads/master@{#36936}

Port 7ceed92a
Port 89d8c57b

Original commit message:

    Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
    introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
    similar to what we already did for Float64Log and Float64Log1p. Rewrite
    Math.atan() and Math.atan2() as TurboFan builtin and use the operators
    to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

    Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
    TurboFan operator based on that, similar to what we do for Float64Log.
    Rewrite Math.log1p() as TurboFan builtin and use that operator to also
    inline Math.log1p() into optimized TurboFan functions.

    Also unify the handling of the special IEEE 754 functions somewhat in
    the TurboFan backends. At some point we can hopefully express this
    completely in the InstructionSelector (once we have an idea what to do
    with the ST(0) return issue on IA-32/X87).

    Drive-by-fix: Add some more test coverage for the log function.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5086,v8:5092,v8:5095
LOG=N

Review-Url: https://codereview.chromium.org/2061753002
Cr-Commit-Position: refs/heads/master@{#36935}

Port e95cfafb

Original commit message:

    This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
    longer assume that the strict arguments object being allocated will fit
    into new-space. The case where said object needs to move to large object
    space is now handled in the runtime.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:614727
LOG=N

Review-Url: https://codereview.chromium.org/2060893002
Cr-Commit-Position: refs/heads/master@{#36934}

In order to update v8 api and still be able to build chromium, we had to keep
code in suboptimal state. Now when chromium caught up, we can perform cleanup :)

LOG=no
BUG=468240

Review-Url: https://codereview.chromium.org/2057613002
Cr-Commit-Position: refs/heads/master@{#36933}

Fix bugs and add a few small useful features:

* Fix Schedule view to properly parse schedule output and respond to switching
  back to graph views.
* Add shorcuts for showing edges of selected nodes.
  - 'i' shows all inputs
  - 'o' shows all outputs
  - '1'-'9' shows all nodes nth input where 1 <= n <= 9
  - 'c' shows all control inputs
  - 'e' shows all effect inputs
* Holding the control key down when using a edge-showing shortcut toggles edge
  state rather the just showing.
* 'a' selects all nodes in graph view.
* Node selection is preserved between graph views and Schedule views.
* Holding control key down when using regular expression search shows currently
  hidden nodes that match the regex search.
* Pane expansion buttons now respond to clicks in entire button area.
* Default text in regex search box makes searching more discoverable.

Review-Url: https://codereview.chromium.org/2059193002
Cr-Commit-Position: refs/heads/master@{#36932}

R=bmeurer@chromium.org, bradnelson@chromium.org
BUG=v8:5086, v8:5095

Review-Url: https://codereview.chromium.org/2062773002
Cr-Commit-Position: refs/heads/master@{#36931}

It's sufficient to bailout when seeing that the function literal is a
generator or async function, as those are the only cases in which there can be
yields.

Also: add a comment on --turbo-from-bytecode and Ignition generators.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2060843002
Cr-Commit-Position: refs/heads/master@{#36930}

It seems that I forgot to remove the DCHECK when refactoring this
function, even though the comment had it right.  It also seems that
this is hard to trigger.  The minimal example I found, after fuzzer's
bug, was:

   eval, x[eval]

R=adamk@chromium.org
BUG=chromium:619476
LOG=N

Review-Url: https://codereview.chromium.org/2058413002
Cr-Commit-Position: refs/heads/master@{#36929}

The AstNumberingVisitor is by now strictly running after we allocated
the SharedFunctionInfo. This removes some left-over code from before
that invariant was holding.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/1965803002
Cr-Commit-Position: refs/heads/master@{#36928}

TBR=bmeurer@chromium.org
BUG=chromium:619538

Review-Url: https://codereview.chromium.org/2066493002
Cr-Commit-Position: refs/heads/master@{#36927}

When running with FLAG_runtime_call_stats, native accessor accesses must
go through the runtime for accurate accounting. Previously the slow_stub()
was used as a handler in order to accomplish this, but it could never be
looked up from the code cache successfully due to mismatched code flags,
which could cause more handler recompilations than in normal operation.
This patch fixes that by emitting a runtime call into the compiled
handler instead of using the slow_stub().

Drive-by cleanup: drop the unused StoreIC_Megamorphic builtin.

Review-Url: https://codereview.chromium.org/2054133002
Cr-Commit-Position: refs/heads/master@{#36926}

Revert of [wasm] Refactor function name table and lookup (patchset #2 id:20001 of https://codereview.chromium.org/2057523002/ )

Reason for revert:
[Sheriff] Speculative revert for flaky gc stress crashes, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/6592
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6143

Original issue's description:
> [wasm] Refactor function name table and lookup
>
> The function name table will now always be set; a CHECK will fail if
> the length would exceed the integer range.
> Also, the resolution of undefined function names to "<WASM UNNAMED>" is
> moved over to the wasm side.
>
> R=titzer@chromium.org
>
> Committed: https://crrev.com/3400ee9f4f21a455b7850ec42a4182a3c0eba310
> Cr-Commit-Position: refs/heads/master@{#36918}

TBR=titzer@chromium.org,clemensh@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2062793002
Cr-Commit-Position: refs/heads/master@{#36925}

This moves the decision whether to optimize generator or async functions
into the AstNumberingVisitor. Optimization heuristics that are based on
the function source should be encapsulated in this class.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2065543002
Cr-Commit-Position: refs/heads/master@{#36924}

Revert of Replace all remaining Oddball checks with new function (patchset #10 id:180001 of https://codereview.chromium.org/2043183003/ )

Reason for revert:
failing tests

Original issue's description:
> Replace all remaining Oddball checks with new function
>
> This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
> The new method all take the isolate as parameter.
>
> BUG=
>
> Committed: https://crrev.com/ccefb3ae5fe967288d568013fb04e8761eafebc5
> Cr-Commit-Position: refs/heads/master@{#36921}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2060213002
Cr-Commit-Position: refs/heads/master@{#36923}

This makes the aforementioned visitation function independent of the
target architecture by leveraging existing abstractions.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2060173002
Cr-Commit-Position: refs/heads/master@{#36922}

This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
The new method all take the isolate as parameter.

BUG=

Review-Url: https://codereview.chromium.org/2043183003
Cr-Commit-Position: refs/heads/master@{#36921}

Array.prototype.sort would not work properly on sloppy arguments of size > 2.

BUG=chromium:618613

Review-Url: https://codereview.chromium.org/2051413004
Cr-Commit-Position: refs/heads/master@{#36920}

We'd like to track performance metrics in an automated way. This CL introduces
--turbo-stats-nvp which exposes --turbo-stats information in {"name"=value} pair
format.

BUG=

Review-Url: https://codereview.chromium.org/2053383002
Cr-Commit-Position: refs/heads/master@{#36919}

The function name table will now always be set; a CHECK will fail if
the length would exceed the integer range.
Also, the resolution of undefined function names to "<WASM UNNAMED>" is
moved over to the wasm side.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2057523002
Cr-Commit-Position: refs/heads/master@{#36918}

This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
longer assume that the strict arguments object being allocated will fit
into new-space. The case where said object needs to move to large object
space is now handled in the runtime.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-614727
BUG=chromium:614727

Review-Url: https://codereview.chromium.org/2054853002
Cr-Commit-Position: refs/heads/master@{#36917}

Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
similar to what we already did for Float64Log and Float64Log1p. Rewrite
Math.atan() and Math.atan2() as TurboFan builtin and use the operators
to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

R=yangguo@chromium.org
BUG=v8:5086,v8:5095

Review-Url: https://codereview.chromium.org/2065503002
Cr-Commit-Position: refs/heads/master@{#36916}

Review-Url: https://codereview.chromium.org/2033423002
Cr-Commit-Position: refs/heads/master@{#36915}

Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.log1p() as TurboFan builtin and use that operator to also
inline Math.log1p() into optimized TurboFan functions.

Also unify the handling of the special IEEE 754 functions somewhat in
the TurboFan backends. At some point we can hopefully express this
completely in the InstructionSelector (once we have an idea what to do
with the ST(0) return issue on IA-32/X87).

Drive-by-fix: Add some more test coverage for the log function.

R=yangguo@chromium.org
BUG=v8:5086,v8:5092

Review-Url: https://codereview.chromium.org/2060743002
Cr-Commit-Position: refs/heads/master@{#36914}

Instead of manually adopting the ancient fdlibm sources, import the msun
versions from FreeBSD instead, which were already adopted to ANSI C.
Still under the same copyright.

R=yangguo@chromium.org
BUG=v8:5065,v8:5086

Review-Url: https://codereview.chromium.org/2065473002
Cr-Commit-Position: refs/heads/master@{#36913}

We were able to achieve our goals for register allocation independent of
the allocation algorithm. Performance data so far is inconclusive re. the
value of the Greedy algorithm, compared to the particular Linear Scan
implementation we're currently using, and the performance measurement
techniques we currently use are too imprecise to help with this matter.

Retiring the algorithm to lower maintenance and evolution cost (e.g. lower
cost of adding aliasing support). Once we improve benchmarking stability,
and establish a suite sensitive enough for codegen improvement studies,
we may revive the algorithm, should the need arise.

BUG=

Review-Url: https://codereview.chromium.org/2060673002
Cr-Commit-Position: refs/heads/master@{#36912}

MemoryOperands, on IA32. This needed to be fixed so that we can
compile wasm code before creating instances, since the compiled code
needs to be patched up for memory and globals references.

This surfaces in asm-to-wasm scenarios.

Added testing (rather, enhanced existing tests).
Note patch#1 where we fail on ia32, and patch#2 with the fix.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2061583002
Cr-Commit-Position: refs/heads/master@{#36911}

Revert of Add a trace-event for each runtime-stats timer (patchset #6 id:100001 of https://codereview.chromium.org/2052523002/ )

Reason for revert:
Seems to break TSAN, see http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/10057

Original issue's description:
> The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.
>
> As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/44ec143f26769bd103662643bfeafc7d0834cc90
> Cr-Commit-Position: refs/heads/master@{#36909}

TBR=cbruni@chromium.org,fmeawad@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5089

Review-Url: https://codereview.chromium.org/2064553002
Cr-Commit-Position: refs/heads/master@{#36910}

The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.

As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.

BUG=v8:5089

Review-Url: https://codereview.chromium.org/2052523002
Cr-Commit-Position: refs/heads/master@{#36909}

Rolling v8/build to ea70305807f935b36a930586aa08c66bfc6fbf8d

Rolling v8/tools/mb to 649b5791b19e4ed3df0c5542b23950d34ca8f3e7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2063593002
Cr-Commit-Position: refs/heads/master@{#36908}

It is expected that temporarily used strings die while they are
in new heap.  So we can avoid to pay a heavy cost to externalize
them.  If they are used for times, externalization will happen
when they move to an old heap.

BUG=chrmoium:606093

Review-Url: https://codereview.chromium.org/2046933002
Cr-Commit-Position: refs/heads/master@{#36907}

Rolling v8/build to e3d91384eb1f9ee5d3a26ad790f87fc51f3cfc61

Rolling v8/tools/clang to 7f07c3fce21f45df52cf39f0f52277d19b7e3573

Rolling v8/tools/mb to ad1b97c34985d6c464b5b74e75c7c9ec9716fec2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2057403004
Cr-Commit-Position: refs/heads/master@{#36906}

Review-Url: https://codereview.chromium.org/2053393004
Cr-Commit-Position: refs/heads/master@{#36905}

Port c8ac0d86

Original commit message:

    Instead, always tail call to the runtime. Also, cleanup the various versions
    of the runtime call that is used for Array construction fallback. There can be
    only one.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2060483002
Cr-Commit-Position: refs/heads/master@{#36904}

This patch adds a test for async/await analogous to a previous Promise test.
It also fixes a typo in promise.js and makes a previous Promise test more
correct by ensuring that all assertions run before completion, fixing the
test expectations for the real result (which seems correct).

BUG=v8:4483
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2037653002
Cr-Commit-Position: refs/heads/master@{#36903}

Port 757221e5

Original commit message:

    Neither globals nor lookup slots can be hole-initialized anymore, thus
    removing some dead code from the code generators and runtime-scopes.

R=adamk@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2060473002
Cr-Commit-Position: refs/heads/master@{#36902}

Port c8ac0d86

Original commit message:

    Instead, always tail call to the runtime. Also, cleanup the various versions
    of the runtime call that is used for Array construction fallback. There can be
    only one.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2057253002
Cr-Commit-Position: refs/heads/master@{#36901}