BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1177263002

Cr-Commit-Position: refs/heads/master@{#28960}

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178953003.

Cr-Commit-Position: refs/heads/master@{#28959}

Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}

@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1175973002

Cr-Commit-Position: refs/heads/master@{#28953}

port dd854449 (r28839)

original commit message:

    Boolean "is_strong" parameters have begun to proliferate across areas where
    strong mode semantics are different. This CL repurposes the existing
    ObjectStrength enum as a replacement for them.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173973002

Cr-Commit-Position: refs/heads/master@{#28952}

port b27016b7 (r28827).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1178533002

Cr-Commit-Position: refs/heads/master@{#28951}

port bd32a9f7 (r28825).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173963002

Cr-Commit-Position: refs/heads/master@{#28950}

port 345fa142 (r28802).

    port of r28769 overwrite some of r28802 so we port them again.

original commit message:

    Before this we had 3 super related lexical bindings that got injected
    into method bodies: .home_object, .this_function,  and new.target.
    With this change we get rid of the .home_object one in favor of using
    .this_function[home_object_symbol] which allows some simplifications
    throughout the code base.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173933005

Cr-Commit-Position: refs/heads/master@{#28949}

port e4782a9b (r28782)

original commit message:

    Previously the %_DateField intrinsic would also check the object and
    throw an exception if you happen to pass something that is not a valid
    JSDate, which (a) violates our policy for instrinsics and (b) is hard to
    optimize in TurboFan (even Crankshaft has a hard time, but there we will
    never inline the relevant builtins, so it doesn't show up). The throwing
    part is now a separate intrinsics %_ThrowIfNotADate that throws an
    exception in full codegen and deoptimizes in Crankshaft, which means the
    code for the current use cases is roughly the same (modulo some register
    renamings/gap moves).

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1174913002

Cr-Commit-Position: refs/heads/master@{#28948}

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178883003

Cr-Commit-Position: refs/heads/master@{#28947}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1172683003

Cr-Commit-Position: refs/heads/master@{#28946}

Merge a following arithmetic or logical right shift into the existing shift
of ARM64's Int32MulHigh or Uint32MulHigh code.

BUG=

Review URL: https://codereview.chromium.org/1179503003

Cr-Commit-Position: refs/heads/master@{#28945}

Revert of [arm64][turbofan]: Handle any immediate shift. (patchset #1 id:1 of https://codereview.chromium.org/1179733004/)

Reason for revert:
Breaks InstructionSelectorTest.Word64ShrWithWord64AndWithImmediate on debug builds (but not optdebug builds). I'll investigate.

Original issue's description:
> [arm64][turbofan]: Handle any immediate shift.
>
> With this patch, we can generate simple immediate-shift instructions for
> immediates outside the range "0 <= imm < width". Several related
> instruction selectors have also been updated accordingly.
>
> Example of generated code:
>
>     ---- Before ---         ---- After ----
>     movz w0, #33            lsr w0, w1, #1
>     lsr  w0, w1, w0
>
> BUG=
>
> Committed: https://crrev.com/36d771bbfa4af5efcc1c1dcf5b234445cb7ee722
> Cr-Commit-Position: refs/heads/master@{#28943}

TBR=bmeurer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176393002

Cr-Commit-Position: refs/heads/master@{#28944}

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179733004

Cr-Commit-Position: refs/heads/master@{#28943}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1175113005

Cr-Commit-Position: refs/heads/master@{#28942}

NOTRY=true

Review URL: https://codereview.chromium.org/1179693005

Cr-Commit-Position: refs/heads/master@{#28941}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1178103002

Cr-Commit-Position: refs/heads/master@{#28940}

BUG=

Review URL: https://codereview.chromium.org/1173243003

Cr-Commit-Position: refs/heads/master@{#28939}

The alternative of passing an object template at context creation is
unfeasible because we need a context to instantiate the template.
At the time we create the context from snapshot or bootstrap from
scratch, we would already need that template instance, leading to a
chicken-and-egg problem.

This is an alternative that is simpler and less intrusive.

R=domenic@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1182443002

Cr-Commit-Position: refs/heads/master@{#28938}

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1178123002

Cr-Commit-Position: refs/heads/master@{#28937}

NOTRY=true

Review URL: https://codereview.chromium.org/1180473003

Cr-Commit-Position: refs/heads/master@{#28936}

R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1177743002

Cr-Commit-Position: refs/heads/master@{#28935}

Revert of [heap] Unify the immortal immovable root detection mechanism. (patchset #3 id:40001 of https://codereview.chromium.org/1178853002/)

Reason for revert:
[Sheriff] tsan failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4240

Original issue's description:
> [heap] Unify the immortal immovable root detection mechanism.
>
> Uniformly use the Heap::GetRootListIndex() and
> Heap::RootIsImmortalImmovable() methods to detect immortal immovable
> roots in the optimizing compilers.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/84e83da99a72edc169367bf88588b1a2f10c2e08
> Cr-Commit-Position: refs/heads/master@{#28933}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178083003

Cr-Commit-Position: refs/heads/master@{#28934}

Uniformly use the Heap::GetRootListIndex() and
Heap::RootIsImmortalImmovable() methods to detect immortal immovable
roots in the optimizing compilers.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1178853002

Cr-Commit-Position: refs/heads/master@{#28933}

Revert of Add CHECKs to verify that we never finalize stale copies of external strings (patchset #1 id:1 of https://codereview.chromium.org/1160253010/)

Reason for revert:
not needed anymore

Original issue's description:
> Add CHECKs to verify that we never finalize stale copies of external strings
>
> BUG=none
> R=ulan@chromium.org
> LOG=n
>
> Committed: https://crrev.com/ca2f8d811ca08783e38ce5dd42d38a6b6a7b876f
> Cr-Commit-Position: refs/heads/master@{#28811}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1178703008

Cr-Commit-Position: refs/heads/master@{#28932}

Revert of Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1181533006/)

Reason for revert:
[Sheriff] Changes/breaks layout tests. Please land upstream needsmanualrebaseline requests first or fix the tests.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/400
One test fails, one times out. See e.g. expectations changes:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/400/layout-test-results/inspector/sources/debugger-async/async-callstack-promises-diff.txt

On linux debug theses tests crash:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/346
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/346/layout-test-results/results.html

Original issue's description:
> Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
>
> Reason for revert:
> Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.
>
> Original issue's description:
> > Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
> >
> > Reason for revert:
> > Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
> >
> > Original issue's description:
> > > Promise assimilation fix.
> > >
> > > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > > should call |y.then|, but the current implementation calls PromiseChain.
> > > We can see the difference when we set a custom function to |y.then|.
> > >
> > > This CL fixes the spec violation, but as a result |then| is no longer
> > > a wrapper of |chain| and in some cases it does not work well with
> > > |accept| or |chain|. That is not a problem for ES6 promise users because
> > > ES6 promise doesn't have them.
> > >
> > > LOG=N
> > > BUG=477921
> > >
> > > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > > Cr-Commit-Position: refs/heads/master@{#28926}
> >
> > TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=477921
> >
> > Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> > Cr-Commit-Position: refs/heads/master@{#28927}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/6f214bdd8bcdc76d48bd85c3bd897f0e2427ff95
> Cr-Commit-Position: refs/heads/master@{#28928}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181603003

Cr-Commit-Position: refs/heads/master@{#28931}

Cr-Commit-Position: refs/heads/master@{#28930}

Revert of Re-land: Enable external startup by default on Linux. (patchset #3 id:40001 of https://codereview.chromium.org/1041683002/)

Reason for revert:
Revert, due to problems with stale build artefacts uncovered by this.

Details: https://code.google.com/p/v8/issues/detail?id=4171

Original issue's description:
> Re-land: Enable external startup by default on Linux.
>
> crrev.com/1016603004 should have fixed the issues that broke this last time.
>
> Notes:
> - The current functionality is meant to stay. If you prefer the old way,
>   just set v8_use_external_startup_data=0.
> - You might notice this if you call d8 via PATH. Either explicitly tell d8
>   where your external snapshot/built-ins are, or change the build options
>   as above.
> - This follows Chromium practice, that mostly uses this feature these days.
> - Other platforms to follow later.
>
> BUG=
>
> Committed: https://crrev.com/bb9c774c164c3552b67b4f1b60809852a44f2ecd
> Cr-Commit-Position: refs/heads/master@{#28858}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1177883003

Cr-Commit-Position: refs/heads/master@{#28929}

Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)

Reason for revert:
Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.

Original issue's description:
> Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
>
> Reason for revert:
> Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
>
> Original issue's description:
> > Promise assimilation fix.
> >
> > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > should call |y.then|, but the current implementation calls PromiseChain.
> > We can see the difference when we set a custom function to |y.then|.
> >
> > This CL fixes the spec violation, but as a result |then| is no longer
> > a wrapper of |chain| and in some cases it does not work well with
> > |accept| or |chain|. That is not a problem for ES6 promise users because
> > ES6 promise doesn't have them.
> >
> > LOG=N
> > BUG=477921
> >
> > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > Cr-Commit-Position: refs/heads/master@{#28926}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> Cr-Commit-Position: refs/heads/master@{#28927}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181533006

Cr-Commit-Position: refs/heads/master@{#28928}

Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)

Reason for revert:
Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829

Original issue's description:
> Promise assimilation fix.
>
> Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> should call |y.then|, but the current implementation calls PromiseChain.
> We can see the difference when we set a custom function to |y.then|.
>
> This CL fixes the spec violation, but as a result |then| is no longer
> a wrapper of |chain| and in some cases it does not work well with
> |accept| or |chain|. That is not a problem for ES6 promise users because
> ES6 promise doesn't have them.
>
> LOG=N
> BUG=477921
>
> Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> Cr-Commit-Position: refs/heads/master@{#28926}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1176163004

Cr-Commit-Position: refs/heads/master@{#28927}

Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
should call |y.then|, but the current implementation calls PromiseChain.
We can see the difference when we set a custom function to |y.then|.

This CL fixes the spec violation, but as a result |then| is no longer
a wrapper of |chain| and in some cases it does not work well with
|accept| or |chain|. That is not a problem for ES6 promise users because
ES6 promise doesn't have them.

LOG=N
BUG=477921

Review URL: https://codereview.chromium.org/1098663002

Cr-Commit-Position: refs/heads/master@{#28926}

Make sure we do not start incremental marking in idle notification when incremental marking is turned off via flags.

BUG=chromium:498315
LOG=n

Review URL: https://codereview.chromium.org/1177953002

Cr-Commit-Position: refs/heads/master@{#28925}

This fixes a failure in test/mjsunit/regress/regress-crbug-491062.js.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1174693002

Cr-Commit-Position: refs/heads/master@{#28924}

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1175963002

Cr-Commit-Position: refs/heads/master@{#28923}

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

Review URL: https://codereview.chromium.org/1175953002

Cr-Commit-Position: refs/heads/master@{#28922}