Found this while working on the unit tests for split/splinter/merge. The
dependency is unnecessary and hinders testability.

BUG=

Review URL: https://codereview.chromium.org/1325453005

Cr-Commit-Position: refs/heads/master@{#30465}

The constructor taking an artificial raw address was only used as a
workaround in TurboFan. It should only be accessible by constructor
functions internal to Unique<T>.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1326493002

Cr-Commit-Position: refs/heads/master@{#30464}

Revert of [heap] More flag cleanup. (patchset #8 id:140001 of https://codereview.chromium.org/1314863003/ )

Reason for revert:
Breaks http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20-%202/builds/2372

Original issue's description:
> [heap] GC flag cleanup/restructuring.
>
> * GC's flags are now proper flags and not int.
> * Callback flags are not threaded through but only set once like gc flags
> * Callers of methods that trigger GCs need to pass a reason when not using
>   the default parameters.
>
> Furthermore, each GC invocation can be passed the GC and GCCallback flags. We
> usually override the currently set flags upon finishing a GC cylce, but are able
> to restore the previously set if desired. This is useful for explicitely
> triggered scavenges or external requests that interrupt the current behaviour.
>
> BUG=
>
> Committed: https://crrev.com/f4f3b431b9ce0778d926acf03c0d36dae5c0cba4
> Cr-Commit-Position: refs/heads/master@{#30457}

TBR=hpayer@chromium.org,yangguo@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1303393004

Cr-Commit-Position: refs/heads/master@{#30463}

Revert of Native context: install array methods via runtime import. (patchset #1 id:1 of https://codereview.chromium.org/1324483002/ )

Reason for revert:
This breaks builds without i18n support. Bisected locally. See builder:

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/4285

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/4285/steps/Check/logs/Threading1

# Fatal error in .././src/objects-inl.h, line 1381
# Check failed: READ_FIELD(this, offset)->IsSmi().

Original issue's description:
> Native context: install array methods via runtime import.
>
> R=cbruni@chromium.org
>
> Committed: https://crrev.com/08ee2132a818a0178038afa521ca06c297195cc9
> Cr-Commit-Position: refs/heads/master@{#30446}

TBR=cbruni@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1314193003

Cr-Commit-Position: refs/heads/master@{#30462}

I plan to reuse this for live range splitting/splintering/merging tests.

BUG=

Review URL: https://codereview.chromium.org/1305313008

Cr-Commit-Position: refs/heads/master@{#30461}

port 09de997b (r30442).

original commit message:

    This adds a new ToString runtime function and a fast-path ToStringStub
    (which is just a simple dispatcher for existing functionality), and also
    implements %_ToName using the ToStringStub.

R=weiliang.lin@intel.com
BUG=

Review URL: https://codereview.chromium.org/1326473002

Cr-Commit-Position: refs/heads/master@{#30460}

R=adamk@chromium.org
LOG=N
BUG=v8:4397,v8:4394

Review URL: https://codereview.chromium.org/1318253002

Cr-Commit-Position: refs/heads/master@{#30459}

The usage of Unique<T> throughout the TurboFan IR does not have any
advantage. There is no single point in time when they are initialized
and most use-sites looked through to the underlying Handle<T> anyways.
Also there already was a mixture of Handle<T> versus Unique<T> in the
graph and this unifies the situation to use Handle<T> everywhere.

R=bmeurer@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/1314473007

Cr-Commit-Position: refs/heads/master@{#30458}

* GC's flags are now proper flags and not int.
* Callback flags are not threaded through but only set once like gc flags
* Callers of methods that trigger GCs need to pass a reason when not using
  the default parameters.

Furthermore, each GC invocation can be passed the GC and GCCallback flags. We
usually override the currently set flags upon finishing a GC cylce, but are able
to restore the previously set if desired. This is useful for explicitely
triggered scavenges or external requests that interrupt the current behaviour.

BUG=

Review URL: https://codereview.chromium.org/1314863003

Cr-Commit-Position: refs/heads/master@{#30457}

Splintering relies on DetachAt, which in turn relies on
FirstSearchIntervalForPosition to find the first UseInterval
to split, given a position. The later API (Find...) has an
optimization for linear traversals. Splintering traverses
linearly (block by block), so we leverage the same
optimization by moving current_interval_ forward.

(Also added an unrelated TODO.)

BUG=chromium:524880
LOG=n

Review URL: https://codereview.chromium.org/1322623007

Cr-Commit-Position: refs/heads/master@{#30456}

v8 is optimized for speed. Because GCC LTO merges flags at link time,
we disable LTO to prevent any -O2 flags from taking precedence over v8's
-Os flag. However, LLVM LTO does not work this way so we keep LTO enabled
under LLVM.

This fixes the ARM build in the cfi_vptr==1 configuration, which requires
LLVM LTO.

R=adamk@chromium.org
BUG=chromium:469376
LOG=N

Review URL: https://codereview.chromium.org/1295673002

Cr-Commit-Position: refs/heads/master@{#30455}

This patch changes the switch scope desugaring to create blocks which
propagate their 'return value' for eval.

BUG=v8:4399
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1309303006

Cr-Commit-Position: refs/heads/master@{#30454}

Switch statements introduce their own scope for cases, but this scope
is not necessarily executed in order, as the following function shows:

  switch (x) {
    case 1:
      let y = 1;
    case 2:
      y = 2;
    case 3:
      print(y);
  }

If x = 2 or x = 3, the code should throw a ReferenceError. However,
FullCodeGen's hole check elimination used the simple algorithm of
assuming that if the initializer was in the same scope, then it was
reached before the use, and therefore the hole check could be
eliminated.

This patch adds an extra bit to scopes, to track if they may
nonlinearly. The parser marks the scope that switch introduces as
nonlinear. FullCodeGen does not eliminate the hole check from
a scope which is nonlinear. This patch refactors FullCodeGen to
put the hole check elimination in one place, rather than in each
backend.

BUG=v8:3926
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1312613003

Cr-Commit-Position: refs/heads/master@{#30453}

Disable the polyfill in simd.js tests as the functions for Phase 1 have been implemented.

BUG=v8:4124
LOG=N

R=bbudge@chromium.org, bmeurer@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1305923005

Cr-Commit-Position: refs/heads/master@{#30452}

This patch makes 'let' a contextual keyword in both strict and sloppy mode.
It behaves as a keyword when used at the beginning of a StatementListItem
or lexical declaration at the beginning of a for statement, if it is followed
by an identifier, [ or {. Implementing this change requires an extra token
look-ahead by the parser which is only invoked in certain cases (so as to
avoid parsing RegExps as ECMAScript tokens). This might result in a slowdown
of the scanner, but performance testing of this patch hasn't yet found much
of a regression.

BUG=v8:3305
LOG=Y
R=adamk,vogelheim

Review URL: https://codereview.chromium.org/1315673009

Cr-Commit-Position: refs/heads/master@{#30451}

Adds support to the interpreter for loading literals from the constant pool.
Adds the LoadConstant bytecode and makes use of it for loading large Smis and
HeapObject literals.

Also removes unused HandleVector from utils.h.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1321663003

Cr-Commit-Position: refs/heads/master@{#30450}

Port 09de997b

Original commit message:
    This adds a new ToString runtime function and a fast-path ToStringStub
    (which is just a simple dispatcher for existing functionality), and also
    implements %_ToName using the ToStringStub.

R=bmeurer@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1310493004

Cr-Commit-Position: refs/heads/master@{#30449}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1314973004

Cr-Commit-Position: refs/heads/master@{#30448}

This avoids a whole range traversal each time we encounter a deferred
block (or a succession of them). The traversal (in the removed
IsIntervalAlreadyExcluded) is unnecessary - an interval with a hole
where deferred blocks are shouldn't be listed in the in/out sets of
those blocks in the first place.

It turns out the root cause (that appeared like we had to special
case ranges with holes, as the comment described) was deferred
blocks with a deoptimization call. That would place the live range
in the in_set of the block, but then splitting would fail because the start
and split position would be the same - this is because everywhere else,
the deferred block would have at least a second instruction, other
than the use - like a jump - ahead of which we'd perform the lower
part of the splintering. In the usual case, this choice of a position
avoids moves on the hot path (because any moves will be before the
jump, but still in the deferred block).

With deoptimization calls, that's not the case, there is just one
instruction, the deoptimization call. So we perform the second cut of
the splintering right after the block. Since there is no control flow from
the deoptimization block to any functional block - the control flow
goes to the exit block - the range connector won't insert moves on the
hot path - although we may want to see what happens for the exit
block, and maybe teach the range connector to ignore control flow
appearing to come from blocks with deoptimization calls.

Review URL: https://codereview.chromium.org/1323473003

Cr-Commit-Position: refs/heads/master@{#30447}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1324483002

Cr-Commit-Position: refs/heads/master@{#30446}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1303953007

Cr-Commit-Position: refs/heads/master@{#30445}

We can set the property in the MISS handler before organizing our handlers
for element-based keyed stores. Since the property set may fail with an
exception, this saves work.

BUG=

Review URL: https://codereview.chromium.org/1308073010

Cr-Commit-Position: refs/heads/master@{#30444}

This data structure uses the public heap API only and is not specific
to any heap internals. It should be usable throughout V8 and inclusion
of the header file should not be restricted.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1320503004

Cr-Commit-Position: refs/heads/master@{#30443}

This adds a new ToString runtime function and a fast-path ToStringStub
(which is just a simple dispatcher for existing functionality), and also
implements %_ToName using the ToStringStub.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319973007

Cr-Commit-Position: refs/heads/master@{#30442}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1320103002

Cr-Commit-Position: refs/heads/master@{#30441}

port 5d975694 (r30403)

original commit message:

    Adds support for parameters to the BytecodeArrayBuilder and BytecodeGenerator.
    Parameters are accessed as negative interpreter registers.

R=weiliang.lin@intel.com
BUG=

Review URL: https://codereview.chromium.org/1324453003

Cr-Commit-Position: refs/heads/master@{#30440}

R=mcilroy@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1310283005

Cr-Commit-Position: refs/heads/master@{#30439}

R=cbruni@chromium.org,mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1318043002

Cr-Commit-Position: refs/heads/master@{#30438}

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1325453002 .

Cr-Commit-Position: refs/heads/master@{#30437}

The magic "print(i)" work-around was no longer work-arounding correctly,
so we do the right thing instead now.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1306843004 .

Cr-Commit-Position: refs/heads/master@{#30436}

This adds a %ToName runtime entry that uses the previously introduced
Object::ToName, which is based on the new Object::ToPrimitive method.
Also removes the need to expose ToName in various way via the builtins
and/or context.

Drive-by-fix: Let %HasProperty do the ToName conversion implicitly as
required.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319133002

Cr-Commit-Position: refs/heads/master@{#30435}

This is the first step towards a spec compliant ToPrimitive
implementation (and therefore spec compliant ToNumber, ToString,
ToName, and friends).  It adds support for the @@toPrimitive
symbol that was introduced with ES2015, and also adds the new
Symbol.prototype[@@toPrimitive] and Date.prototype[@@toPrimitive]
initial properties.

There are now runtime functions for %ToPrimitive, %ToNumber and
%ToString, which do the right thing and should be used as fallbacks
instead of the hairy runtime.js implementations.  I will do the
same for the other conversion operations mentioned by the spec in
follow up CLs.  Once everything is in place we can look into
optimizing things further, so that we don't always call into the
runtime.

Also fixed Date.prototype.toJSON to be spec compliant.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=y

Review URL: https://codereview.chromium.org/1306303003

Cr-Commit-Position: refs/heads/master@{#30434}

Reduce the number of entrypoints to the compiler pipeline by one. Always require caller to provide a CompilationInfo.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1317113004

Cr-Commit-Position: refs/heads/master@{#30433}

Also, polymorphic element stores have a slightly different shape for the array
attached to a vector slot. It's of the form [map, map, handler], where the 2nd
map is either a transition map or undefined (the maps are actually in
WeakCells).

Review URL: https://codereview.chromium.org/1316953003

Cr-Commit-Position: refs/heads/master@{#30432}

R=adamk@chromium.org
LOG=N
BUG=v8:4397

Review URL: https://codereview.chromium.org/1320673007

Cr-Commit-Position: refs/heads/master@{#30431}

Account for the constant pool pointer slot during register allocation
data initialization.

R=danno@chromium.org, titzer@chromium.org, bmeurer@chromium.org, mcilroy@chromium.org,
TEST=cctest/test-run-machops/RunSpillConstantsAndParameters
BUG=

Review URL: https://codereview.chromium.org/1317123003

Cr-Commit-Position: refs/heads/master@{#30430}

Float32x4, Int32x4, Uint32x4:
  store, store1, store2, store3

Int16x8, Int8x16, Uint16x8, Uint8x16:
  store

BUG=v8:4124
LOG=N

R=bbudge@chromium.org, littledan@chromium.org, jarin@chromium.org

Review URL: https://codereview.chromium.org/1304183004

Cr-Commit-Position: refs/heads/master@{#30429}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1322523004

Cr-Commit-Position: refs/heads/master@{#30428}

Remove CompilationInfo::MayUseThis() and replace it with what we really want to know: MustReplaceUndefinedReceiverWithGlobalProxy.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1312713004

Cr-Commit-Position: refs/heads/master@{#30427}

If JSON contains SyntaxError then V8 will report exception and won't report compile error.

LOG=Y
BUG=chromium:515382
R=yangguo@chromium.org,yurys@chromium.org

Review URL: https://codereview.chromium.org/1308123006

Cr-Commit-Position: refs/heads/master@{#30426}