Port 18b9c1ce

Original commit message:
    Per ProxyCreate() (https://tc39.github.io/ecma262/#sec-proxycreate), a Proxy
    is only given a [[Call]] slot if the target has a [[Call]] slot as well. This
    was previously implemented correctly for [[Construct]], but not for [[Call]].

R=caitpotter88@gmail.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4797, v8:4796, v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1758283002

Cr-Commit-Position: refs/heads/master@{#34465}

Sets the code up so it'll be easier to have section names as strings instead of
hard-coded numbers. Using strings will require synchronizing with sexpr-wasm.

Mostly NFC (besides now skipping *all* unknown sections).

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1743773002

Cr-Commit-Position: refs/heads/master@{#34464}

This adds new code stubs for abstract relational comparison,
namely LessThanStub, LessThanOrEqualStub, GreaterThanStub and
GreaterThanOrEqualStub, and hooks them up for Ignition and TurboFan.
These stubs implement the full compare operation without any
unpredictable bailouts. Currently they still go to C++ for string
comparisons, and also use the %ToPrimitive_Number runtime entry, as
we still lack a stub for the ToPrimitive operation. These issues
will be addressed separately in follow-up CLs.

Drive-by-fix: Add support for deferred code in the RawMachineAssembler
and CodeStubAssembler. A block can be marked as deferred by marking its
Label as deferred, which will then make the register allocator penalize
this block and prefer better register assignments for the other blocks.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1759133002

Cr-Commit-Position: refs/heads/master@{#34463}

Port 2689548e

Original commit message:
    These new stubs perform exactly the same job as the string equality case
    for the CompareIC, but are platform independent and usable outside of
    fullcodegen and Crankshaft. We use them in the StrictEqualStub and the
    StrictNotEqualStub instead of falling back to the runtime immediately
    for String comparisons, and we also use them in TurboFan to perform
    String equality or inequality comparisons.

    These stubs currently handle only internalized and one byte strings w/o
    going to C++, but it should be easy to add support for more string cases
    later, i.e. utilizing already flattened cons strings or comparing two
    byte strings as well.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1763723002

Cr-Commit-Position: refs/heads/master@{#34462}

Per ProxyCreate() (https://tc39.github.io/ecma262/#sec-proxycreate), a Proxy
is only given a [[Call]] slot if the target has a [[Call]] slot as well. This
was previously implemented correctly for [[Construct]], but not for [[Call]].

BUG=v8:4797, v8:4796, v8:1543
LOG=N
R=cbruni@chromium.org, neis@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1752133004

Cr-Commit-Position: refs/heads/master@{#34461}

Changes MacroAssembler::GenerateSwitchTable to make sure that 'ra' is properly restored.

BUG=

Review URL: https://codereview.chromium.org/1761863002

Cr-Commit-Position: refs/heads/master@{#34460}

These new stubs perform exactly the same job as the string equality case
for the CompareIC, but are platform independent and usable outside of
fullcodegen and Crankshaft. We use them in the StrictEqualStub and the
StrictNotEqualStub instead of falling back to the runtime immediately
for String comparisons, and we also use them in TurboFan to perform
String equality or inequality comparisons.

These stubs currently handle only internalized and one byte strings w/o
going to C++, but it should be easy to add support for more string cases
later, i.e. utilizing already flattened cons strings or comparing two
byte strings as well.

Review URL: https://codereview.chromium.org/1761823002

Cr-Commit-Position: refs/heads/master@{#34459}

This is more consistent with the current naming scheme (i.e. IsCallable
for callable bit on map, IsConstructor for constructor bit on map, and
now IsUndetectable for undetectable bit on map).

Also simplify the fallthrough case for Object::Equals, because we don't
need to check for Null or Undefined or Undetectable, as both Null and
Undefined already have the undetectable bit set on their maps.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1756413003

Cr-Commit-Position: refs/heads/master@{#34458}

This reverts commit 2608ecc7.

Revert "Specialize helper methods in the LookupIterator by is_element."

This reverts commit 6eb483f8.

Revert "Avoid SetPropertyInternal if the LookupIterator is NotFound"

This reverts commit ca5bd8d4.

Revert "Inline fast-bailout-checks for LookupIterator::UpdateProtector"

This reverts commit d98570a1.

This breaks layout tests with timeouts:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5060

It also seems to break jsfunfuzz:
https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/7930

The other three CLs are reverted to be able to revert the first.

BUG=v8:4798
LOG=n
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1761593003

Cr-Commit-Position: refs/heads/master@{#34457}

The support was already removed from the Crankshaft and this CL removes the last piece.

Review URL: https://codereview.chromium.org/1764593002

Cr-Commit-Position: refs/heads/master@{#34456}

BUG=

Review URL: https://codereview.chromium.org/1755013003

Cr-Commit-Position: refs/heads/master@{#34455}

  port 4acb492e (r34423)

  original commit message:
  Initial version of a new StrictEqualStub written as TurboFan code stub,
  that implements the full strict equality comparison and is usable for
  both TurboFan and Ignition (and soon for the generic CompareIC case
  too). The stub is not fully optimized yet, i.e. we still go to the
  runtime for string comparisons, but that'll be addressed in a follow-up
  CL.

BUG=

Review URL: https://codereview.chromium.org/1762533002

Cr-Commit-Position: refs/heads/master@{#34454}

  port c129aa4d (r34239)

  original commit message:
  These macro operators represent a conditional eager deoptimization exit
  without explicit branching, which greatly reduces overhead of both
  scheduling and register allocation, and thereby greatly reduces overall
  compilation time, esp. when there are a lot of eager deoptimization
  exits.

BUG=

Review URL: https://codereview.chromium.org/1762483003

Cr-Commit-Position: refs/heads/master@{#34453}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org,yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1729833002

Cr-Commit-Position: refs/heads/master@{#34452}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=wasm-fuzzer
R=titzer@chromium.org,kcc@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1760033002

Cr-Commit-Position: refs/heads/master@{#34451}

BUG=

Review URL: https://codereview.chromium.org/1597163002

Cr-Commit-Position: refs/heads/master@{#34450}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1756693003

Cr-Commit-Position: refs/heads/master@{#34449}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1756303002

Cr-Commit-Position: refs/heads/master@{#34448}

Newly added tests cause failures on 32-bit bigendian and are skipped
until a solution is found.

R=titzer@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1761573002

Cr-Commit-Position: refs/heads/master@{#34447}

BUG=v8:4766
LOG=N

Review URL: https://codereview.chromium.org/1751963003

Cr-Commit-Position: refs/heads/master@{#34446}

We cannot optimize away ToNumber conversions based on the Type that we
see in Crankshaft, as this might be the (unchecked or even pretruncated)
lower bound. We can only use the HType, which is based on the definition.

R=jkummerow@chromium.org
BUG=chromium:590989
LOG=n

Review URL: https://codereview.chromium.org/1757013002

Cr-Commit-Position: refs/heads/master@{#34445}

Port 4acb492e

Original commit message:
    Initial version of a new StrictEqualStub written as TurboFan code stub,
    that implements the full strict equality comparison and is usable for
    both TurboFan and Ignition (and soon for the generic CompareIC case
    too). The stub is not fully optimized yet, i.e. we still go to the
    runtime for string comparisons, but that'll be addressed in a follow-up
    CL.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1756243002

Cr-Commit-Position: refs/heads/master@{#34444}

The ES2016 draft spec defines a sort of fast path for constructing
a TypedArray based on another TypedArray. This patch implements that
alternative path in TypedArray construction. It is verified by
test262 tests, which now pass. This patch also has a slight cleanup
of TypedArray code by using a macro for TypedArray type checks, as
is done for other types.

This patch includes a minor spec violation: In the same-type case, the
spec indicates that the underlying ArrayBuffer should be copied until
the end, and this is fixed up by making the [[ArrayLength]] shorter.
This is observable with the buffer getter. This patch just copies the
used part of the underlying ArrayBuffer.

R=adamk
BUG=v8:4726
LOG=Y

Review URL: https://codereview.chromium.org/1754593003

Cr-Commit-Position: refs/heads/master@{#34443}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1760613002

Cr-Commit-Position: refs/heads/master@{#34442}

The CompilationPhase helper class is only used in Crankshaft and is not
suitable for use in other compilers. This factors is out into a separate
file and moves it into the "crankshaft" directory.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1758773002

Cr-Commit-Position: refs/heads/master@{#34441}

There is no reason to keep around the HOptimizedGraphBuilder after the
graph has successfully been built. Later phases in OptimizedCompileJob
should not rely on it anymore.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1756183002

Cr-Commit-Position: refs/heads/master@{#34440}

Avoid pushing null arguments.

BUG=
TEST=cctest/test-run-machops/RunCallCFunction8

Review URL: https://codereview.chromium.org/1758813002

Cr-Commit-Position: refs/heads/master@{#34439}

BUG=

Review URL: https://codereview.chromium.org/1754023003

Cr-Commit-Position: refs/heads/master@{#34438}

BUG=

Review URL: https://codereview.chromium.org/1756883002

Cr-Commit-Position: refs/heads/master@{#34437}

BUG=

Review URL: https://codereview.chromium.org/1752383002

Cr-Commit-Position: refs/heads/master@{#34436}

Fix additional cases where the AIX compiler reports that a variable
may be used uninitialized.

R=danno@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1755673002

Cr-Commit-Position: refs/heads/master@{#34435}

R=mythria@chromium.org, rmcilroy@chromium.org
BUG=v8:4689
LOG=N

Review URL: https://codereview.chromium.org/1759673002

Cr-Commit-Position: refs/heads/master@{#34434}

BUG=

Review URL: https://codereview.chromium.org/1758733002

Cr-Commit-Position: refs/heads/master@{#34433}

Otherwise e.g.,
"use strict";
class C { static f() { super.location = "http://bla.com" }}
C.f.call(this);

will mask location on the hidden prototype of the JSGlobalObject.

BUG=

Review URL: https://codereview.chromium.org/1757933002

Cr-Commit-Position: refs/heads/master@{#34432}

It used to say "Unexpected token ILLEGAL", now it says "Invalid or unexpected token".

R=jkummerow@chromium.org
BUG=chromium:257405
LOG=N

Review URL: https://codereview.chromium.org/1758663002

Cr-Commit-Position: refs/heads/master@{#34431}

This speeds up lookup.

BUG=

Review URL: https://codereview.chromium.org/1753273002

Cr-Commit-Position: refs/heads/master@{#34430}

This introduces a new instance type and reorders the JSObject types so any type requiring special LookupIterator support can be identified with a single range check.

In addition, it restructures the Next for better performance, avoiding unnecessary calls.

BUG=

Review URL: https://codereview.chromium.org/1751043002

Cr-Commit-Position: refs/heads/master@{#34429}

BUG=

Review URL: https://codereview.chromium.org/1753803003

Cr-Commit-Position: refs/heads/master@{#34428}

This relaxes the constraints of the optimized code map in order to be
able to update existing entries. It also simplifies the interface a
little bit. We can now insert an entry for a newly allocated literals
array together with previously cached context-independent code.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1753213002

Cr-Commit-Position: refs/heads/master@{#34427}

Generalize the code that we have for StrictEqualStub to also general a
StrictNotEqualStub and hook that up with TurboFan and Ignition. It's
still falling back to the runtime for every String (in)equality check.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1756793002

Cr-Commit-Position: refs/heads/master@{#34426}