This way we avoid the second deoptimization for the Math.floor and
Math.ceil builtins when -0 is involved. We still deoptimize the inlined
Crankshaft version in various cases, that's a separate issue.

The algorithm used for implement CodeStubAssembler::Float64Floor is
vaguely based on the fast math version used in the libm of various BSDs,
but had to be reengineered to match the EcmaScript specification.

R=epertoso@chromium.org
BUG=v8:2890, v8:4059
LOG=n

Review URL: https://codereview.chromium.org/1828253002

Cr-Commit-Position: refs/heads/master@{#35083}

Clang optimizes away CheckOverflowForIntSub at any opt
level (includes -O1, -O2, -O3) into a false statement,
resulting in incorrect values being returned. As the C++
standard considers overflows to be undefined behaviour,
this is technically correct as compilers can assume that
overflows never occur, but problematic in our case (where
overflows do occur, and a specific result is expected).

This change replaces the original check with a call to a
function that is optimized in a manner that returns correct output.

R=michael_dawson@ca.ibm.com,jyan@ca.ibm.com,mtbrandyberry@ca.ibm.com,joransiu@ca.ibm.com,danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1826043002

Cr-Commit-Position: refs/heads/master@{#35082}

Add support for optimizing objects with elements, which do not invoke JS and
cannot change the shape of the Object.

BUG=v8:4663
LOG=N

Review URL: https://codereview.chromium.org/1767113004

Cr-Commit-Position: refs/heads/master@{#35081}

Rolling v8/build/gyp to 28340b46df65f2c84f7793470189a0b395e1c9a4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1839563002

Cr-Commit-Position: refs/heads/master@{#35080}

BUG=v8:4680
LOG=n
NOTRY=true
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1836763002

Cr-Commit-Position: refs/heads/master@{#35079}

TBR=ishell@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1834083002

Cr-Commit-Position: refs/heads/master@{#35078}

Rolling v8/tools/clang to 43ef5b7210286664ce0ed7581c90e7797d80ea28

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1831303005

Cr-Commit-Position: refs/heads/master@{#35077}

It's been on since M49. Also moved tests from harmony -> es6,
one of which was merged with another test of the same name.

While moving stuff over to regexp.js, I also noticed that there
were unused calls to %FunctionSetName and %SetNativeFlag (those
calls are already handled by InstallGetter()).

Review URL: https://codereview.chromium.org/1838563003

Cr-Commit-Position: refs/heads/master@{#35076}

"IS_RECEIVER" used to be called "IS_SPEC_OBJECT", which might be a better
name: it's what the spec means when it says "Type(O) is Object".

R=littledan@chromium.org
BUG=v8:4602
LOG=n

Review URL: https://codereview.chromium.org/1838593002

Cr-Commit-Position: refs/heads/master@{#35075}

BUG=v8:4737
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1676613002

Cr-Commit-Position: refs/heads/master@{#35074}

Use macro instructions for min, max ops to get the same functionality on
pre-r6 and r6 targets.

BUG=
TEST=mjsunit/math-min-max, cctest/test-macro-assembler-mips64/min_max_nan, cctest/test-macro-assembler-mips/min_max_nan, cctest/test-assembler-mips64/min_max, cctest/test-assembler-mips/min_max

Review URL: https://codereview.chromium.org/1694833002

Cr-Commit-Position: refs/heads/master@{#35073}

Port b6419fa2

Now implemented as a builtin that delegates to the InstanceOfStub. That
stub was parameterized to fallback to either Runtime_InstanceOf or to
Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
Once the feature stabilizes and the flag is no longer needed, we can get
rid of this parameterization again.

BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1832053002

Cr-Commit-Position: refs/heads/master@{#35072}

This is another set of changes that replace JR and JALR instructions
with JIC and JIALC for mips32r6. Macroassembler Jump and Call functions
now use JIC and JIALC if branch delay slot is not used. Code patching is
adjusted to work with new changes and few minor fixes are added.

BUG=

Review URL: https://codereview.chromium.org/1807263003

Cr-Commit-Position: refs/heads/master@{#35071}

Rolling v8/buildtools to 80b5126f91be4eb359248d28696746ef09d5be67

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1834743004

Cr-Commit-Position: refs/heads/master@{#35070}

A bug in error printing meant that we failed to do proper type checks
before calling into C++ code, which could lead to RUNTIME_ASSERT
failures if methods are called on alternative receivers. This patch
adds the right type checks.

BUG=chromium:596718
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1831053003

Cr-Commit-Position: refs/heads/master@{#35069}

This patch implements ES2015 RegExp subclassing semantics, namely the
hardest part where RegExp.prototype.exec and certain flag getters can
be overridden in order to provide different behavior. This change is
hidden behind a new flag, --harmony-regexp-exec. The flag guards the
behavior by installing entirely different implementations of the
methods which follow the new semantics.

Preliminary performance tests show a 3-4x regression in the Octane
RegExp benchmark. The new code doesn't call out into several fast
paths that the old code supported, so this is expected.

The patch is tested mostly by test262, where most RegExp tests are fixed,
with the exception of deliberate spec violations for web compatibility,
and for the 'sticky' flag, which is not dynamically read by this patch
in all cases but rather statically compiled into the RegExp. The latter
will require a follow-on patch to implement. A small additional set of
tests verifies one particular case, mostly to check whether the flag
mechanism works.

R=adamk,yangguo@chromium.org
LOG=Y
BUG=v8:4602

Review URL: https://codereview.chromium.org/1596483005

Cr-Commit-Position: refs/heads/master@{#35068}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1830703003

Cr-Commit-Position: refs/heads/master@{#35067}

Makes --ignition cause eager compilation if we aren't building the startup
snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1811553003

Cr-Commit-Position: refs/heads/master@{#35066}

Revert of [Interpreter] Adds support to fetch return value on break at return. (patchset #9 id:160001 of https://codereview.chromium.org/1818873003/ )

Reason for revert:
[Sheriff] Seems to break nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/6019

Original issue's description:
> [Interpreter] Adds support to fetch return value on break at return.
>
> Debugger fetches the return value of a function when we break at return.
> Interpreter holds the return value in accumulator. This is not stored in a
> specified location on stack and hence it is not possible to look it up from
> stack similar to full-codegen or optimized frames. This cl adds support to
> store the value of accumulator on debug breaks. The value of accumulator is
> passed to the runtime function and is then stored in thread local data.
>
> Also changes full-codegen implementation to match that of ignition.
> The return value from full-codegen is also stored in thread local data.
> The return value is fetched directly thread local data instead of
> finding it by iterating over frames.
>
> BUG=v8:4280, v8:4690
> LOG=N
>
> Committed: https://crrev.com/fb65527b75754bcf3b173f16f5d0b04a1c6d9b99
> Cr-Commit-Position: refs/heads/master@{#35060}

TBR=rmcilroy@chromium.org,yangguo@chromium.org,weiliang.lin@intel.com,balazs.kilvady@imgtec.com,jyan@ca.ibm.com,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4690

Review URL: https://codereview.chromium.org/1834733002

Cr-Commit-Position: refs/heads/master@{#35065}

This previously tickled the failure fixed in this issue:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=asm-wasm-deopt
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1766153002

Cr-Commit-Position: refs/heads/master@{#35064}

gc-stress failure believed to have been fixed in:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/embenchen
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1827813006

Cr-Commit-Position: refs/heads/master@{#35063}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1830723003

Cr-Commit-Position: refs/heads/master@{#35062}

Spec http://tc39.github.io/proposal-string-pad-start-end/

BUG=
LOG=Y
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1700003002

Cr-Commit-Position: refs/heads/master@{#35061}

Debugger fetches the return value of a function when we break at return.
Interpreter holds the return value in accumulator. This is not stored in a
specified location on stack and hence it is not possible to look it up from
stack similar to full-codegen or optimized frames. This cl adds support to
store the value of accumulator on debug breaks. The value of accumulator is
passed to the runtime function and is then stored in thread local data.

Also changes full-codegen implementation to match that of ignition.
The return value from full-codegen is also stored in thread local data.
The return value is fetched directly thread local data instead of
finding it by iterating over frames.

BUG=v8:4280, v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1818873003

Cr-Commit-Position: refs/heads/master@{#35060}

Revert of [Interpreter] Remove separate Ignition snapshot. (patchset #2 id:20001 of https://codereview.chromium.org/1833643002/ )

Reason for revert:
Makes nosnap bots timeout due to having to rebuild bytecode handlers.

Original issue's description:
> [Interpreter] Remove separate Ignition snapshot.
>
> Removes the seperate Ignition snapshot and build the Ignition bytecode
> handlers in the default snapshot.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/1798f3fe84faff32ba44e09f6aed79245dd98d80
> Cr-Commit-Position: refs/heads/master@{#35058}

TBR=machenbach@google.com,yangguo@chromium.org,mstarzinger@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1827143002

Cr-Commit-Position: refs/heads/master@{#35059}

Removes the seperate Ignition snapshot and build the Ignition bytecode
handlers in the default snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1833643002

Cr-Commit-Position: refs/heads/master@{#35058}

BUG=chromium:568949
LOG=n
TBR=kjellander@chromium.org, tandrii@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1830153002

Cr-Commit-Position: refs/heads/master@{#35057}

R=jarin@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1828223002

Cr-Commit-Position: refs/heads/master@{#35056}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1827873002

Cr-Commit-Position: refs/heads/master@{#35055}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1832653002

Cr-Commit-Position: refs/heads/master@{#35054}

Based on CL 1777883002.

BUG=chromium:590975
LOG=NO

Review URL: https://codereview.chromium.org/1813963002

Cr-Commit-Position: refs/heads/master@{#35053}

It might happen a script is gone during profiling. Handle that case.

Review URL: https://codereview.chromium.org/1826953003

Cr-Commit-Position: refs/heads/master@{#35052}

Introduce TruncateTaggedToFloat64 and TruncateTaggedToWord32 into the
CodeStubAssembler, which encapsulates the ToNumber truncation and
returns the resulting number as either Float64 or further truncated to
Word32.

R=jarin@chromium.org
BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1827813004

Cr-Commit-Position: refs/heads/master@{#35051}

Rolling v8/build/gyp to 8e8c3178d9d2734a6223b87fbd45ab250baf77e8

Rolling v8/tools/clang to c789a99803595dfa963ba300ac79b760d1304d8c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1834583002

Cr-Commit-Position: refs/heads/master@{#35050}

ES#sec-islabelledfunction specifies that labelled function declarations
may not occur as the body of a control flow construct such as an if
statement. This patch implements those restrictions, which also
eliminates a previous case resulting in a DCHECK failure which is now
a SyntaxError.

BUG=chromium:595309
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1808373003

Cr-Commit-Position: refs/heads/master@{#35049}

This was previously undetected due to a now fixed typing bug.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1823333005

Cr-Commit-Position: refs/heads/master@{#35048}

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1832623003

Cr-Commit-Position: refs/heads/master@{#35047}

Properly convert unsigned literals.
Forbid using unary + on a kAsmInt.
Forbid multiplies other than * 1.0 as being equivalent to unary +.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1832603002

Cr-Commit-Position: refs/heads/master@{#35046}

R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1825333004

Cr-Commit-Position: refs/heads/master@{#35045}

BUG=

Review URL: https://codereview.chromium.org/1826023003

Cr-Commit-Position: refs/heads/master@{#35044}