Revert of [es6] Ship new ES6 instanceof operator semantics. (patchset #1 id:1 of https://codereview.chromium.org/1820903002/ )

Reason for revert:
Breaks two layout tests when rolling into Chromium. Tests needs investigation and most likely a rebaseline. The following are the tests that fail:

- imported/web-platform-tests/html/semantics/text-level-semantics/the-time-element/001.html
- fast/dom/Window/window-postmessage-clone-deep-array.html

https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64/5594/layout-test-results/results.html

Original issue's description:
> [es6] Ship new ES6 instanceof operator semantics.
>
> R=hablich@chromium.org
> BUG=v8:4447
> LOG=n
>
> Committed: https://crrev.com/5836807ea89b96ecfb4bbd8febf0d67bb8dae9ed
> Cr-Commit-Position: refs/heads/master@{#34984}

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4447

Review URL: https://codereview.chromium.org/1823813003

Cr-Commit-Position: refs/heads/master@{#34995}

This adds two new stubs, AddStub and SubtractStub, for the plus and the
minus operators, and hooks them up with TurboFan and Ignition.
Especially the addition case is very heavy and we might want to look
into splitting that up further into specialized stubs (similar to what
we did with ToNumberStub recently).

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1823083002

Cr-Commit-Position: refs/heads/master@{#34994}

Cleanup, and matches Chromium's build.

Review URL: https://codereview.chromium.org/1820583002

Cr-Commit-Position: refs/heads/master@{#34993}

BUG=v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1782743003

Cr-Commit-Position: refs/heads/master@{#34992}

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1821183002

Cr-Commit-Position: refs/heads/master@{#34991}

Otherwise, no handler would be dumped when using a snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1821663002

Cr-Commit-Position: refs/heads/master@{#34990}

This CL adds support for builtins with JavaScript linkage written using
the TurboFan CodeStubAssembler, but with a JSCall descriptor (which was
already supported thanks to a previous patch by Ben Smith). As a first
example, we convert the Math.sqrt builtin and thereby get rid of the
%_MathSqrt intrinsic, which causes trouble for the representation
selection pass in the JavaScript pipeline.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1824993002

Cr-Commit-Position: refs/heads/master@{#34989}

* Not jump around all memory to gather whether we need to profile
* Cache this information and dispatch to a templatized function

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1820263002

Cr-Commit-Position: refs/heads/master@{#34988}

This roughly doubles performance for generic Array.prototype.push.

BUG=

Review URL: https://codereview.chromium.org/1816553002

Cr-Commit-Position: refs/heads/master@{#34987}

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1819073003

Cr-Commit-Position: refs/heads/master@{#34986}

The linter (i.e. cpplint.py) no longer needs to check for alpha-sorted
include directives because our source formatting (i.e. clang-format)
will take care of this by now. This is the current default configuration
of the underlying linter anyways.

Note that the two tools disagree about the correct ordering about files
containing dash characters. The ordering suggested by the formatter is
more natural. Having the formatter trigger linter errors is not a good
situation to be in.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1822003002

Cr-Commit-Position: refs/heads/master@{#34985}

R=hablich@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1820903002

Cr-Commit-Position: refs/heads/master@{#34984}

Introduces a bytecode whose handler executes the equivalent of %_IsArray and %_IsJSReceiver without a runtime call.

BUG=v8:4822
LOG=y

Review URL: https://codereview.chromium.org/1645763003

Cr-Commit-Position: refs/heads/master@{#34983}

Fixes CopyBytecodeArray to set the interrupt_budget field.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1809123003

Cr-Commit-Position: refs/heads/master@{#34982}

The JSFunction::PassesFilter predicate is not fine-grained enough to
actually distinguish different closures and hence can be changed into
SharedFunctionInfo::PassesFilter instead. This will allow the compiler
to use is more broadly.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1823033002

Cr-Commit-Position: refs/heads/master@{#34981}

BUG=

Review URL: https://codereview.chromium.org/1806283004

Cr-Commit-Position: refs/heads/master@{#34980}

... because Debugger could still require them to inspect optimized frames.

BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1816113002

Cr-Commit-Position: refs/heads/master@{#34979}

The idiv instruction has 2 registers as output. This needs to be
modeled so that the move optimizer won't incorrectly elide away
moves.

BUG=

Review URL: https://codereview.chromium.org/1818323002

Cr-Commit-Position: refs/heads/master@{#34978}

The CL also add guard nodes to places where we assume that certain
values are numbers.

Review URL: https://codereview.chromium.org/1821133002

Cr-Commit-Position: refs/heads/master@{#34977}

This was once meant to be used for JavaScript code stubs, but since we
found a better way to do code stubs using TurboFan, we don't need this
runtime entry and intrinsic anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1821123002

Cr-Commit-Position: refs/heads/master@{#34976}

  port b6419fa2 (r34959)

  original commit message:
  Now implemented as a builtin that delegates to the InstanceOfStub. That
  stub was parameterized to fallback to either Runtime_InstanceOf or to
  Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
  Once the feature stabilizes and the flag is no longer needed, we can get
  rid of this parameterization again.

BUG=

Review URL: https://codereview.chromium.org/1821113002

Cr-Commit-Position: refs/heads/master@{#34975}

  port 22523f25 (r34925)

  original commit message:
  This is in preparation for a CL that does the equivalent of http://crrev.com/1780193003 for ia32.

BUG=

Review URL: https://codereview.chromium.org/1823943002

Cr-Commit-Position: refs/heads/master@{#34974}

BUG=

Review URL: https://codereview.chromium.org/1824893002

Cr-Commit-Position: refs/heads/master@{#34973}

  port acbb968d (r34920)

  original commit message:
  In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
  Otherwise we will see G in a stack trace inside H.

  This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

BUG=

Review URL: https://codereview.chromium.org/1819273003

Cr-Commit-Position: refs/heads/master@{#34972}

  port b7aa4c3a (r34922)

  original commit message:
  Split ToNumberStub into the entry ToNumberStub, and two new stubs,
  StringToNumberStub and NonNumberToNumberStub, which can be used when we
  already know something about the input (i.e. in various branches of the
  code stubs, or in TurboFan graphs).

  Also introduce an appropriate StringToNumber simplified operator for
  TurboFan, that is pure and is lowered to an invocation of the newly
  added StringToNumberStub.

BUG=

Review URL: https://codereview.chromium.org/1816423002

Cr-Commit-Position: refs/heads/master@{#34971}

Rolling v8/third_party/android_tools to 19728471dd63a968668288488403286b68e4ae9e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1821943002

Cr-Commit-Position: refs/heads/master@{#34970}

BUG=v8:3915
LOG=N
R=adamk@chromium.org, littledan@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1823683004

Cr-Commit-Position: refs/heads/master@{#34969}

Flags --dump_wasm_module and --dump_wasm_module_path=/path/to/folder allow us to run a bunch of tests and capture all of the wasm module files including the ones that come from the .js and .cc tests which are built on the fly, as well as the asm2wasm tests.

The files are all uniquely named `HASH.{ok,failed}.wasm`.

This will be especilly useful for fuzz testing, but could also be used for other tests including non-V8 tests.

For now I manually hacked tools/testrunner/local/execution.py so that tools/run-tests.py can output the modules. We may want to ad a flag to run-tests.py proper if this turns out to be useful.

R=bradnelson@chromium.org, titzer@chromium.org, kcc@chromium.org

Review URL: https://codereview.chromium.org/1816583003

Cr-Commit-Position: refs/heads/master@{#34968}

Add missing conversions from other types to f32 in fround.
Restrict fround() to only float, double, signed, unsigned (no unions / intish).
Restrict Bitwise operations to intish, particularly |0, when not applied to a foreign function.

Adding more exhaustive tests of stdlib Math, move to a separate file.
Adding tests of interesting values for the stdlib asm.js functions.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1804243003

Cr-Commit-Position: refs/heads/master@{#34967}

Enables the Scanner to provide a better error message when errors occur
in escape sequences, numbers, strings, etc.

BUG=v8:4829, v8:3230
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1793913002

Cr-Commit-Position: refs/heads/master@{#34966}

* Better inlining
* Avoid vtable lookup for visitor

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1818013002

Cr-Commit-Position: refs/heads/master@{#34965}

Both of them shipped in Chrome 49 without incident.

Also move relevant tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1815773002

Cr-Commit-Position: refs/heads/master@{#34964}

BUG=

Review URL: https://codereview.chromium.org/1819813003

Cr-Commit-Position: refs/heads/master@{#34963}

This is necessary to ensure that "Called non callable" exception will get a proper message and stack trace even for calls at tail position.

BUG=chromium:595615, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818003002

Cr-Commit-Position: refs/heads/master@{#34962}

R=littledan@chromium.org
BUG=v8:4810
LOG=N

Review URL: https://codereview.chromium.org/1824613002

Cr-Commit-Position: refs/heads/master@{#34961}

STL requires comparison to be a strict weak ordering.

In particular the predicate should be antisymmetric:
f(x, y) implies !f(y, x).

BUG=v8:4848
LOG=NO

Review URL: https://codereview.chromium.org/1818043004

Cr-Commit-Position: refs/heads/master@{#34960}

Now implemented as a builtin that delegates to the InstanceOfStub. That
stub was parameterized to fallback to either Runtime_InstanceOf or to
Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
Once the feature stabilizes and the flag is no longer needed, we can get
rid of this parameterization again.

R=bmeurer@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1819813002

Cr-Commit-Position: refs/heads/master@{#34959}

Revert of Parser: Make skipping HTML comments optional. (patchset #6 id:140001 of https://codereview.chromium.org/1801203002/ )

Reason for revert:
Violates ES6 spec (crbug.com/4850), and implementation was over-eager. Will revert for now.

Original issue's description:
> Parser: Make skipping HTML comments optional.
>
> API change: This adds a new flag skip_html_comments to v8::ScriptOriginOptions. This flag controls whether V8 will attempt to honour HTML-style comments in JS sources.
>
> (That is: Gracefully ignore <!-- ... ---> in JS sources, which was a popular technique in the early days of JavaScript, to prevent non-JS-enabled browsers from displaying script sources to uses.)
>
> The flag defaults to 'true' when using v8::ScriptOrigin constructor, which preserves the existing behaviour. Embedders which are happy with the existing behaviour will thus not need any changes.
>
> BUG=chromium:573887
> LOG=Y
>
> Committed: https://crrev.com/91d344288aa51ed03eaaa1cb3e368ac1e82f0173
> Cr-Commit-Position: refs/heads/master@{#34904}

TBR=jochen@chromium.org,rossberg@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:573887, v8:4850
LOG=Y

Review URL: https://codereview.chromium.org/1817163003

Cr-Commit-Position: refs/heads/master@{#34958}

We don't want them to disappear from the stack traces.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818063002

Cr-Commit-Position: refs/heads/master@{#34957}

BUG=

Review URL: https://codereview.chromium.org/1823613002

Cr-Commit-Position: refs/heads/master@{#34956}