Now that vector ics are established for load, keyed load and call ics, let's remove dead code behind the flag.

BUG=

Review URL: https://codereview.chromium.org/1129853002

Cr-Commit-Position: refs/heads/master@{#28422}

Reason for revert:
Simulator test failures in RunChangeFloat64ToInt.., RunChangeTaggedToInt32,
div-mul-minus-one

Original issue's description:

> Implement assembler, disassembler tests for all instructions for mips32
> and mips64. Additionally, add missing single precision float instructions
> for r2 and r6 architecture variants in assembler, simulator and disassembler
> with corresponding tests.

BUG=

Review URL: https://codereview.chromium.org/1143473003

Cr-Commit-Position: refs/heads/master@{#28404}

Implement assembler, disassembler tests for all instructions for mips32 and mips64. Additionally, add missing single precision float instructions for r2 and r6 architecture variants in assembler, simulator and disassembler with corresponding tests.

Review URL: https://codereview.chromium.org/1119203003

Cr-Commit-Position: refs/heads/master@{#28402}

... and the following two
"PPC: Resolve references to "this" the same way as normal variables"
"Remove Scope::scope_uses_this_ flag"

R=hablich@chromium.org
BUG=chromium:487289
LOG=N

Review URL: https://codereview.chromium.org/1134003003

Cr-Commit-Position: refs/heads/master@{#28395}

Implements the strong mode proposal's restrictions on implicit conversions
for the binary >, >=, <, and <= operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1130283002

Cr-Commit-Position: refs/heads/master@{#28370}

HMaybeGrowElements moves the situation where you actually have to grow
into deferred code. This means crankshaft doesn't have to spill registers
just to make the bounds comparison to see if it'll need to grow or not.

It makes the growing case a bit more expensive, but reduces the cost of
the general case.

BUG=chromium:484025
LOG=N

Review URL: https://codereview.chromium.org/1124443004

Cr-Commit-Position: refs/heads/master@{#28359}

Port 3226e980

BUG=

Review URL: https://codereview.chromium.org/1129323007

Cr-Commit-Position: refs/heads/master@{#28350}

Port abc35080

BUG=

Review URL: https://codereview.chromium.org/1133103003

Cr-Commit-Position: refs/heads/master@{#28347}

In strong mode it is an error to call a function with too few
arguments.

This is enforced inside the ArgumentsAdaptorTrampoline.

This does not yet handle rest parameters

BUG=v8:3956
LOG=N
R=rossberg@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1115263004

Cr-Commit-Position: refs/heads/master@{#28346}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1139733002

Cr-Commit-Position: refs/heads/master@{#28344}

Make the parser handle references to "this" as unresolved variables, so the
same logic as for the rest of function parameters is used for the receiver.
Minor additions to the code generation handle copying the receiver to the
context, along with the rest of the function parameters.

Based on work by Adrian Perez de Castro <aperez@igalia.com>.

This is a reapplication of https://codereview.chromium.org/1130733003.

R=rossberg@chromium.org
BUG=v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1136073002

Cr-Commit-Position: refs/heads/master@{#28340}

This stub will be used as the basis of a Math.floor-specific CallIC to
detect and track calls to floor that return -0.

Along the way:
- Create a TurboFanCodeStub super class from which the StringLength and
MathRound TF stubs derive.
- Fix the ugly hack that passes the first stub parameter as the "this"
pointer in the the TF-compiled JS function.
- Fix bugs in the ia32/x64 disassembler.

Review URL: https://codereview.chromium.org/1137703002

Cr-Commit-Position: refs/heads/master@{#28339}

Revert of Allow loading holes from holey smi arrays (patchset #2 id:20001 of https://codereview.chromium.org/1134483002/)

Reason for revert:
Shouldn't unconditionally load holes since it tanks performance. I'll change it in a follow-up to only do it if the IC ever saw it happen.

Original issue's description:
> Allow loading holes from holey smi arrays
>
> BUG=
>
> Committed: https://crrev.com/eab5bb5390fab79d063f29398377c6d181963dde
> Cr-Commit-Position: refs/heads/master@{#28298}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1131203002

Cr-Commit-Position: refs/heads/master@{#28309}

BUG=
TEST=mjsunit/asm/embenchen/lua_binarytrees

Review URL: https://codereview.chromium.org/1127393003

Cr-Commit-Position: refs/heads/master@{#28303}

BUG=

Review URL: https://codereview.chromium.org/1134483002

Cr-Commit-Position: refs/heads/master@{#28298}

Revert of Resolve references to "this" the same way as normal variables (patchset #2 id:20001 of https://codereview.chromium.org/1130733003/)

Reason for revert:
[Sheriff] Breaks jetstream benchmark with errors like this:

>>> Running suite: JetStream/bigfib.cpp
>>> Stdout (#1):
undefined:93: ReferenceError: this is not defined
  this['Module'] = Module;
  ^
ReferenceError: this is not defined
    at eval (eval at __run (runner.js:13:3), <anonymous>:93:3)
    at eval (native)
    at __run (runner.js:13:3)
    at Object.runSimpleBenchmark (runner.js:44:31)
    at runner.js:97:13

Original issue's description:
> Resolve references to "this" the same way as normal variables
>
> Make the parser handle references to "this" as unresolved variables, so the
> same logic as for the rest of function parameters is used for the receiver.
> Minor additions to the code generation handle copying the receiver to the
> context, along with the rest of the function parameters.
>
> Based on work by Adrian Perez de Castro <aperez@igalia.com>.
>
> BUG=v8:2700
> LOG=N
>
> Committed: https://crrev.com/06a792b7cc2db33ffce7244c044a9c05afbb6116
> Cr-Commit-Position: refs/heads/master@{#28263}

TBR=rossberg@chromium.org,arv@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2700

Review URL: https://codereview.chromium.org/1129723003

Cr-Commit-Position: refs/heads/master@{#28283}

https://codereview.chromium.org/1125783002 did not handle all cases for some
architectures. These cases are now covered, and tests have been extended to
check them.

BUG=v8:4073
LOG=N

Review URL: https://codereview.chromium.org/1128143002

Cr-Commit-Position: refs/heads/master@{#28266}

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1116943002

Cr-Commit-Position: refs/heads/master@{#28264}

Make the parser handle references to "this" as unresolved variables, so the
same logic as for the rest of function parameters is used for the receiver.
Minor additions to the code generation handle copying the receiver to the
context, along with the rest of the function parameters.

Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1130733003

Cr-Commit-Position: refs/heads/master@{#28263}

typeof was implemented as a runtime function. Calling it in
optimized code with a non-constant input becomes burdensome.

BUG=

Review URL: https://codereview.chromium.org/1114563003

Cr-Commit-Position: refs/heads/master@{#28260}

The Hydrogen representation for binops was never changed to care about the
language mode. We thought this was ok, but it turns out we need to keep track
of it to make sure inlining doesn't mess with the "strongness" of binops.

Also added more rigorous inlining testing.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1123043002

Cr-Commit-Position: refs/heads/master@{#28253}

ArgumentsAdaptorStub for derived constructor (the one that needs
new.target) works in this way:
 - If the constructor is invoked via the Construct stub, we know that
   actual arguments always include new.target. ``arguments`` object
   however should not include a new.target, therefore we remove it.
   We achieve this by decrementing the argument count.
 - If the constructor is invoked as a call, we do not care for a correct
   ``arguments`` array since the constructor will immediately throw on
   entrance.
The bug is that the call could actually pass 0 actual arguments, but I
decrement unconditionally :(. The fix is to detect this case and avoid
decrementing. ``arguments`` is bogus, but it is ok as constructor
throws.

Long-term we should just remove mucking about with arguments for
new.target and just get it from the stack.

R=arv@chromium.org,rossberg@chromium.org
BUG=chromium:474783
LOG=Y

Review URL: https://codereview.chromium.org/1126783003

Cr-Commit-Position: refs/heads/master@{#28242}

- Add long branche mode for FPU branches.
- Fix FPU branches for unordered conditions.
- Provide FPU [un]ordered condition negation schema.

TEST=mjsunit/miror-objects, constant-folding-2, external-array
BUG=

Review URL: https://codereview.chromium.org/1120753010

Cr-Commit-Position: refs/heads/master@{#28241}

Improve d26f5d39

Original commit message:
When comparing a symbol to istself using <, <=, > or >= we need to
throw a TypeError. This is correctly handled in the runtime function
so if we are comparing a symbol fall back to use the runtime.

BUG=

Review URL: https://codereview.chromium.org/1124863004

Cr-Commit-Position: refs/heads/master@{#28240}

Revert of Collect type feedback on result of Math.[round|ceil|floor] (patchset #13 id:230001 of https://codereview.chromium.org/1053143005/)

Reason for revert:
All sorts of performance regressions

Original issue's description:
> Collect type feedback on result of Math.[round|ceil|floor]
>
> By recording invocations of these builtins that can return -0, we now learn to not emit Crankshaft code that only handles integer results, avoiding deopt loops.
>
> Committed: https://crrev.com/f36ecaf3a4d61568ca50a20718acce7dd5da9a5f
> Cr-Commit-Position: refs/heads/master@{#28215}

TBR=mvstanton@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1115973005

Cr-Commit-Position: refs/heads/master@{#28237}

When comparing a symbol to istself using <, <=, > or >= we need to
throw a TypeError. This is correctly handled in the runtime function
so if we are comparing a symbol fall back to use the runtime.

BUG=v8:4073
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1125783002

Cr-Commit-Position: refs/heads/master@{#28226}

By recording invocations of these builtins that can return -0, we now learn to not emit Crankshaft code that only handles integer results, avoiding deopt loops.

Review URL: https://codereview.chromium.org/1053143005

Cr-Commit-Position: refs/heads/master@{#28215}

BUG=v8:3985
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1122083002

Cr-Commit-Position: refs/heads/master@{#28206}

BUG=

Review URL: https://codereview.chromium.org/1120093002

Cr-Commit-Position: refs/heads/master@{#28200}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1118693002

Cr-Commit-Position: refs/heads/master@{#28181}

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/1106383008

Cr-Commit-Position: refs/heads/master@{#28179}

Just give internal ones an ArrayBuffer with a NULL backing store. This
simplifies the access checks a lot.

BUG=v8:3996
R=hpayer@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1109353003

Cr-Commit-Position: refs/heads/master@{#28168}

We were deopting without learning anything.

This is a rebase/reland of https://codereview.chromium.org/368263003

BUG=v8:3417
LOG=N

Review URL: https://codereview.chromium.org/1109333003

Cr-Commit-Position: refs/heads/master@{#28163}

An initial 'code age' state that will turn into a 'pre-aging' code age only after it was executed the first time.

BUG=470930
LOG=Y

Review URL: https://codereview.chromium.org/1107233004

Cr-Commit-Position: refs/heads/master@{#28162}

Added rounding according to fcsr, CVT_W_D and RINT.D instruction in assembler, dissasembler and simulator and wrote appropiate tests.

BUG=

Review URL: https://codereview.chromium.org/1108583003

Cr-Commit-Position: refs/heads/master@{#28143}

Followup fix of nit discussed in Issue 1111003002.

BUG=

Review URL: https://codereview.chromium.org/1112793004

Cr-Commit-Position: refs/heads/master@{#28130}

BUG=

Review URL: https://codereview.chromium.org/1111003002

Cr-Commit-Position: refs/heads/master@{#28117}

BUG=481519
LOG=y

Review URL: https://codereview.chromium.org/1111633002

Cr-Commit-Position: refs/heads/master@{#28113}

This instruction can be hoisted out of loops even though it contains a branch.

BUG=v8:3996
R=bmeurer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1108313003

Cr-Commit-Position: refs/heads/master@{#28109}

If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}