Review URL: https://codereview.chromium.org/1413153013

Cr-Commit-Position: refs/heads/master@{#31793}

This removes several methods from JSFunction that just delegate to
SharedFunctionInfo. These methods are especially dangerous when they
hide the fact that they potentially affect all function instances
deriving from the same underlying SharedFunctionInfo.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1417213005

Cr-Commit-Position: refs/heads/master@{#31792}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1428203003

Cr-Commit-Position: refs/heads/master@{#31791}

The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31790}

The callees are expected to properly set the number of actual
arguments passed to the callee, which is now represented correctly
in the TurboFan graphs by a new Parameter right before the context
Parameter.  Currently this is only being used for outgoing calls.

Note that this requires disabling two of the TF code stub tests,
because of the JavaScript graphs are not automagically compatible
with abitrary (incoming) code stub interface descriptors.  If we
want to support JS code stubs at all, then we need to find a sane
way to feed in this information.

Drive-by-fix: Don't insert a direct call to a classConstructor.

R=mstarzinger@chromium.org
BUG=v8:4413, v8:4428
LOG=n

Review URL: https://codereview.chromium.org/1410633006

Cr-Commit-Position: refs/heads/master@{#31789}

BUG=

Review URL: https://codereview.chromium.org/1425403002

Cr-Commit-Position: refs/heads/master@{#31788}

Revert of [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor. (patchset #20 id:370001 of https://codereview.chromium.org/1418623007/ )

Reason for revert:
failing build bot

Original issue's description:
> [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
>
> The current implementation of classes throws the TypeError at the wrong
> point, after activating a new context when directly calling a class
> constructor. According to the spec, the TypeError has to be thrown
> in the caller context.
>
> LOG=N
> BUG=v8:4428
>
> Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
> Cr-Commit-Position: refs/heads/master@{#31786}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4428

Review URL: https://codereview.chromium.org/1415783006

Cr-Commit-Position: refs/heads/master@{#31787}

The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1412223018

Cr-Commit-Position: refs/heads/master@{#31785}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1405963011

Cr-Commit-Position: refs/heads/master@{#31784}

Cr-Commit-Position: refs/heads/master@{#31783}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31782}

Call directly into the ArgumentsAdaptorTrampoline when we call a known
JSFunction, but that actual argument count doesn't match the expected
argument count.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1417213004

Cr-Commit-Position: refs/heads/master@{#31781}

Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )

Reason for revert:
Performance issue.

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1409013006

Cr-Commit-Position: refs/heads/master@{#31780}

We don't really care about signedness when truncating to Word32.

Review URL: https://codereview.chromium.org/1417023005

Cr-Commit-Position: refs/heads/master@{#31779}

This makes the description in the README file for our test262 harness
independent of the underlying revision. The one canonical place to
mention the up-to-date revision is the DEPS file.

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1424043006

Cr-Commit-Position: refs/heads/master@{#31778}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1413033014

Cr-Commit-Position: refs/heads/master@{#31777}

This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}

Review URL: https://codereview.chromium.org/1414403003

Cr-Commit-Position: refs/heads/master@{#31775}

Adds support for calling JS runtime functions. Also changes the bytecode
array builder to allow calling functions with an invalid argument
register if the call takes no arguments.

Adds the bytecode CallJSRuntime.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410003003

Cr-Commit-Position: refs/heads/master@{#31774}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31773}

Use the type specified for StoreField and StoreElement to check whether
we are storing a TaggedSigned value, and skip the write barrier for the
write completely in that case.  Also make sure to set that field type
appropriately for JSGlobalObjectSpecialization.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410743009

Cr-Commit-Position: refs/heads/master@{#31772}

We don't need to distinguish between signed and unsigned integral
representations in the big boy type system. It actually even hurts
in some cases. The representation is only about the way the values
are mapped to bits in memory/registers, but the interpretation of
the bits is specified by the semantic dimension.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1416953006

Cr-Commit-Position: refs/heads/master@{#31771}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1422623013

Cr-Commit-Position: refs/heads/master@{#31770}

We used to mark a block as needing frame based solely on
the spill list. With splintering, that is not entirely
accurate. With this change, for ranges that spill only in
deferred blocks, we mark the start of each block in which a
child range spills as needing a frame.

BUG=v8:4533
LOG=n

Review URL: https://codereview.chromium.org/1408183007

Cr-Commit-Position: refs/heads/master@{#31769}

Rolling v8/build/gyp to 2c1e6cced23554ce84806e570acea637f6473afc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1413923012

Cr-Commit-Position: refs/heads/master@{#31768}

The "harmony"-prefixed files have been included in the snapshot for
several releases now, and were only separate originally to enable
loading them via a runtime flag. This patch simply merges them into
the main implementation files for Arrays and TypedArrays, respectively.

Review URL: https://codereview.chromium.org/1416243007

Cr-Commit-Position: refs/heads/master@{#31767}

BUG=

Review URL: https://codereview.chromium.org/1430943004

Cr-Commit-Position: refs/heads/master@{#31766}

Revert of [heap] Turn on parallel compaction (patchset #1 id:1 of https://codereview.chromium.org/1364693002/ )

Reason for revert:
Fails on gc stress
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/157/

Original issue's description:
> [heap] Turn on parallel compaction
>
> R=hpayer@chromium.org
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/04db5bfa915766b228218ddc748af308b57ae8ea
> Cr-Commit-Position: refs/heads/master@{#31763}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1424313008

Cr-Commit-Position: refs/heads/master@{#31765}

Only cast to integer with xor (closer to the spec which allows only ~~).
Check type matching on the bitwise operations.
Prevent mixing of types with the arthimetic operations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1405383007

Cr-Commit-Position: refs/heads/master@{#31764}

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1364693002

Cr-Commit-Position: refs/heads/master@{#31763}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1410633005

Cr-Commit-Position: refs/heads/master@{#31762}

BUG=

Review URL: https://codereview.chromium.org/1396133002

Cr-Commit-Position: refs/heads/master@{#31761}

BUG=v8:3886
LOG=Y

Review URL: https://codereview.chromium.org/1422853004

Cr-Commit-Position: refs/heads/master@{#31760}

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1424283002

Cr-Commit-Position: refs/heads/master@{#31759}

Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )

Reason for revert:
[Sheriff] Changes layout tests. Please rebase upstream first. E.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2686

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1427733005

Cr-Commit-Position: refs/heads/master@{#31758}

Corrects LdaGlobal to deal with TypeofMode::INSIDE_TYPEOF so that it
doesn't throw a reference error on undefined globals.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1422443006

Cr-Commit-Position: refs/heads/master@{#31757}

Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

The problem was in another CL, this is a clean reland with improved tests.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1415683007

Cr-Commit-Position: refs/heads/master@{#31756}

This matches the approach used for @@isConcatSpreadable, and seems to
match what Mozilla is planning to do in Firefox.

Given that there's already little compatibility around cross-origin toString
results, there seems to be little hazard in making this change even before
spec language hits the HTML spec.

BUG=v8:3502, v8:4289, chromium:532469
LOG=n

Review URL: https://codereview.chromium.org/1432543002

Cr-Commit-Position: refs/heads/master@{#31755}

Review URL: https://codereview.chromium.org/1432493003

Cr-Commit-Position: refs/heads/master@{#31754}