This patch implements %_IsTypedArray in fullcodegen, Hydrogen and
Turbofan in order to implement fast type checks to enable ES6
TypedArray features and semantics efficiently.

R=adamk,titzer
LOG=Y
BUG=v8:4085

Review URL: https://codereview.chromium.org/1183213002

Cr-Commit-Position: refs/heads/master@{#29033}

Computed property literals don't seem to work in nosnap yet,
leading to a syntax error.

R=adamk,arv

Review URL: https://codereview.chromium.org/1189643002

Cr-Commit-Position: refs/heads/master@{#29032}

In ES6, the TypedArray constructor can be called either with an
array-like object or an iterable. The code previously handled
only array-like objects. This patch switches to supporting
iterables while throwing in an optimization to make Arrays
get allocated the old way, without an extra copy.

BUG=v8:4090
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1181903003

Cr-Commit-Position: refs/heads/master@{#29031}

TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1185143002

Cr-Commit-Position: refs/heads/master@{#29030}

R=arv@chromium.org,wingo@igalia.com,caitpotter88@gmail.com
LOG=N
BUG=v8:811

Review URL: https://codereview.chromium.org/1167393005

Cr-Commit-Position: refs/heads/master@{#29029}

The TryLowerDirectJSCall method tried to lower to a direct JavaScript
function call depending on the type of the receiver, but only if the
target is a cosntant JSFunction. Since this depends on types and is not
required for correctness, it shouldn't be part of generic lowering
anyway. So this functionality was moved to typed lowering instead, and
we use proper types for the target instead.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1182193005

Cr-Commit-Position: refs/heads/master@{#29028}

Reasons:
- It is not used.
- It complicates code in GC.

BUG=chromium:499713
LOG=NO

Review URL: https://codereview.chromium.org/1184723002

Cr-Commit-Position: refs/heads/master@{#29027}

R=arv@chromium.org, conradw@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1180943007

Cr-Commit-Position: refs/heads/master@{#29026}

This hack doesn't help currently, since it only applies to asm.js where
we do function context specialization and there we already have a
canonicalized context (and the CodeGenerator materializes that from the
frame).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177033006

Cr-Commit-Position: refs/heads/master@{#29025}

Port cdc43bc5

Original review: https://codereview.chromium.org/1133163005/

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1182193004

Cr-Commit-Position: refs/heads/master@{#29024}

R=jkummerow@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1191433003

Cr-Commit-Position: refs/heads/master@{#29023}

Revert of Fix clobbered register when setting this_function variable. (patchset #2 id:20001 of https://codereview.chromium.org/1185703002/)

Reason for revert:
[Sheriff] Makes mjsunit/es6/block-const-assign flaky, e.g.:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/4082

Original issue's description:
> Fix clobbered register when setting this_function variable.
>
> R=arv@chromium.org
> TEST=mjsunit/regress/regress-crbug-498022
> BUG=chromium:498022
> LOG=N
>
> Committed: https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91
> Cr-Commit-Position: refs/heads/master@{#29020}

TBR=arv@chromium.org,rossberg@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:498022

Review URL: https://codereview.chromium.org/1184093003

Cr-Commit-Position: refs/heads/master@{#29022}

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1183133002

Cr-Commit-Position: refs/heads/master@{#29021}

R=arv@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1185703002

Cr-Commit-Position: refs/heads/master@{#29020}

Also fixed the duplicated output of context deopt.

BUG=

Review URL: https://codereview.chromium.org/1187533002

Cr-Commit-Position: refs/heads/master@{#29019}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1186713003

Cr-Commit-Position: refs/heads/master@{#29017}

R=jochen@chromium.org
BUG=v8:4179
LOG=N

Review URL: https://codereview.chromium.org/1183483006

Cr-Commit-Position: refs/heads/master@{#29016}

Doc: https://goo.gl/LLGvBs

BUG=

Review URL: https://codereview.chromium.org/1163143009

Cr-Commit-Position: refs/heads/master@{#29015}

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177293003

Cr-Commit-Position: refs/heads/master@{#29014}

Rolling v8/third_party/android_tools to ed3dde6470c39b196c70f0c20374894d169754ec

Resubmission of https://codereview.chromium.org/1183753006/

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/1181413003

Cr-Commit-Position: refs/heads/master@{#29013}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180113002

Cr-Commit-Position: refs/heads/master@{#29012}

This fixes a few funky implicit conversions for the enum (that are
inconsistent across compilers) and also helps to save space, i.e. for
the representations_ vector in the InstructionSequence.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1182303003

Cr-Commit-Position: refs/heads/master@{#29011}

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1179913003

Cr-Commit-Position: refs/heads/master@{#29010}

Revert of Reland "Keep track of array buffers in new space separately" (patchset #2 id:20001 of https://codereview.chromium.org/1177083003/)

Reason for revert:
Still broken

Original issue's description:
> Reland "Keep track of array buffers in new space separately"
>
> Original review https://codereview.chromium.org/1133773002/
>
> BUG=v8:3996
> TBR=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/89b9a2cfb317e52186f682c91502b22932d52db3
> Cr-Commit-Position: refs/heads/master@{#28987}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1186613007

Cr-Commit-Position: refs/heads/master@{#29009}

Apparently the *RealNamed* API methods only have named variants, but were always used by the embedder to find elements as well. We'd never find them though, since we wouldn't even look
there.

This CL ensures we check whether the name is actually an array index.

I guess for all named API functions we should assume they are used similar to o["name"] where name could also be a number... At least we should make it uniform between embedder and V8. This matches us up with their expectations for now...

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177383004

Cr-Commit-Position: refs/heads/master@{#29008}

Rolling v8/tools/clang to bb23ac0328fd3d051fc2f5ff027c8e0f87cc6fb5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1186753003

Cr-Commit-Position: refs/heads/master@{#29007}

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184853003

Cr-Commit-Position: refs/heads/master@{#29006}

use 1 as allocatable Double register number when setting up the default register configuration..

It does not change the double register configuration of other platforms.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1164813007

Cr-Commit-Position: refs/heads/master@{#29005}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178893002

Cr-Commit-Position: refs/heads/master@{#29004}

      The strong-object-set-proto test cases will throw one expected exception
      and the exception message should include the source position in the JS
      file. But crankshaft compiler does not generate the source position for
      it when creating the flow graph by default. The source position information
      is always zero. So it failed when comparing with the reference file.

      If we use crankshaft compiler on IA32 platform to run this test case, it
      has the same failure.

      we will open these test case for x87 once turbofan for X87 is enabled.

BUG=

Review URL: https://codereview.chromium.org/1179763003

Cr-Commit-Position: refs/heads/master@{#29003}

Otherwise using Object.defineProperty with window.localStorage will not actually store the value into the database but on the object itself.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180073002

Cr-Commit-Position: refs/heads/master@{#29002}

Also use again the taskkill method, recently removed in
https://codereview.chromium.org/1156133006/

BUG=chromium:485932
LOG=n
TBR=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177903005

Cr-Commit-Position: refs/heads/master@{#29001}

Reland of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180943002

Cr-Commit-Position: refs/heads/master@{#29000}

This CL fixes elements kind transitions handling in Map::TryUpdate().

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1181163002

Cr-Commit-Position: refs/heads/master@{#28999}

This is a reapplication of https://codereview.chromium.org/1173333004.

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1178903003

Cr-Commit-Position: refs/heads/master@{#28998}

Up until now we used int32_t for NodeId, but that was not ideal because
negative values are invalid for NodeId and we use it as an array index
for example in the NodeMarker class, where C++ compilers on x64 have to
generate code that does proper sign extension for the indices, which is
completely unnecessary.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1178403004

Cr-Commit-Position: refs/heads/master@{#28997}

Revert of Add script context with context-allocated "const this" (patchset #2 id:20001 of https://codereview.chromium.org/1173333004/)

Reason for revert:
nosnap failure

Original issue's description:
> Add script context with context-allocated "const this"
>
> This is a reapplication of https://codereview.chromium.org/1179893002/.
>
> R=rossberg@chromium.org,mstarzinger@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/cfc764f4050edc74aef92daa4c39ccc113893968
> Cr-Commit-Position: refs/heads/master@{#28994}

TBR=mstarzinger@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1177903004

Cr-Commit-Position: refs/heads/master@{#28996}

Allocation must respect requested reserve size, not requested commit area size.

Additionally fix check failures in debug mode for mips64.
After CL: https://codereview.chromium.org/1147503002/
memory for large code objects is allocated from code range,
memory for regular code objects is allocated normally.

TEST=cctest/test-spaces/MemoryChunk
BUG=

Review URL: https://codereview.chromium.org/1172333002

Cr-Commit-Position: refs/heads/master@{#28995}

This is a reapplication of https://codereview.chromium.org/1179893002/.

R=rossberg@chromium.org,mstarzinger@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1173333004

Cr-Commit-Position: refs/heads/master@{#28994}