From ES6 25.2.3 ("Properties of the GeneratorFunction Prototype
Object"):

> The GeneratorFunction prototype object is an ordinary object. It is
> not a function object and does not have an [[ECMAScriptCode]] internal
> slot or any other of the internal slots listed in Table 27 or Table
> 56.

Introduce one assertion for the value's type and additional tests for its
properties. Remove an invalid assertion that fails as a result of this
fix.

BUG=v8:3991
LOG=N

Review URL: https://codereview.chromium.org/1062633002

Cr-Commit-Position: refs/heads/master@{#27603}

These slots are invalid and can result in a broken offset when slot index and start of object are equal and are at the beginning of a cell.

Moreover, make DCHECKs CHECKs to catch bugs in the wild.

BUG=chromium:473174
LOG=n

Review URL: https://codereview.chromium.org/1051243004

Cr-Commit-Position: refs/heads/master@{#27602}

- Fixed single float register type instruction en[de]coding in assembler and disassembler.
- Added max and min instructions for r6 and corresponding tests.
- Fixed selection instruction for boundary cases in simulator.
- Update assembler tests to be more thorough wrt boundary cases.

TEST=cctest/test-assembler-mips64/MIPS17, MIPS18
     cctest/test-disasm-mips64/Type1
     cctest/test-assembler-mips/MIPS16, MIPS17
     cctest/test-disasm-mips/Type1
BUG=

Review URL: https://codereview.chromium.org/1057323002

Cr-Commit-Position: refs/heads/master@{#27601}

Rolling v8/third_party/icu to e4c31439828d356525b71ef81a6d61ea50d7d673

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1058383002

Cr-Commit-Position: refs/heads/master@{#27600}

The number of generated instructions per table entry is reduced from six to
two, or four in worst-case scenario.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1059213002

Cr-Commit-Position: refs/heads/master@{#27599}

Rolling v8/build/gyp to 2889664b9fa88cce175c5c7cdf207d28420a7412

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1057013003

Cr-Commit-Position: refs/heads/master@{#27598}

port 16ee5509 (r27536)

original commit message:

  Generate common StoreFastElementStubs ahead of time

BUG=

Review URL: https://codereview.chromium.org/1052413002

Cr-Commit-Position: refs/heads/master@{#27597}

port b134ae74 (r27581)

original commit message:

   v8:3539 - hold constructor feedback in weak cells

BUG=

Review URL: https://codereview.chromium.org/1051253004

Cr-Commit-Position: refs/heads/master@{#27596}

port 7c347c54 (r27511)

original commit message:

    A bug allows JSObject literals with elements to have the elements in the
    boilerplate modified.

BUG=

Review URL: https://codereview.chromium.org/1057883004

Cr-Commit-Position: refs/heads/master@{#27595}

Port b134ae74

Original commit message:
BUG=v8:3539
LOG=N

R=verwaest@chromium.org, mbrandy@us.ibm.com

Review URL: https://codereview.chromium.org/1052973003

Cr-Commit-Position: refs/heads/master@{#27594}

Remove unused macro-asm instruction and associated address patching.

On mips64, remove unused JumpLabelToJumpRegister(). On mips, rename
it appropriately (it's still used there for JR->J optimizations).

BUG=

Review URL: https://codereview.chromium.org/1059433003

Cr-Commit-Position: refs/heads/master@{#27593}

As with TF fix 94506cc3, correctly support absurdly large stack
adjustments.

TEST=mozilla/js/tests/js1_5/Regress/regress-396684.js
BUG=

Review URL: https://codereview.chromium.org/1057763002

Cr-Commit-Position: refs/heads/master@{#27592}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1057843002

Cr-Commit-Position: refs/heads/master@{#27591}

BUG=chromium:98597
LOG=N

Review URL: https://codereview.chromium.org/1052943003

Cr-Commit-Position: refs/heads/master@{#27590}

Revert of make ToLocalCheck crash in release mode (patchset #1 id:1 of https://codereview.chromium.org/1043363005/)

Reason for revert:
breaks some devtools things

Original issue's description:
> make ToLocalCheck crash in release mode
>
> R=svenpanne@chromium.org
> BUG=
>
> Committed: https://crrev.com/ce7cc5119c1e031bf1eb8476fbf5e55bef738f94
> Cr-Commit-Position: refs/heads/master@{#27585}

TBR=svenpanne@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1057873003

Cr-Commit-Position: refs/heads/master@{#27589}

This keeps the length of the context chain tracked by the environment
in sync even for local control flow commands. It removes the need to
guess the correct chain length at Environment::Merge points.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1045703003

Cr-Commit-Position: refs/heads/master@{#27588}

BUG=v8:3539
LOG=N

Review URL: https://codereview.chromium.org/1038043002

Cr-Commit-Position: refs/heads/master@{#27587}

BUG=chromium:472513
LOG=Y

Review URL: https://codereview.chromium.org/1058793002

Cr-Commit-Position: refs/heads/master@{#27586}

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1043363005

Cr-Commit-Position: refs/heads/master@{#27585}

R=machenbach@chromium.org
BUG=chromium:408675
LOG=N

Review URL: https://codereview.chromium.org/1051653003

Cr-Commit-Position: refs/heads/master@{#27584}

The original code will not update the IC info if one of parameter is SMI. It Can not handle Number + Smi.

BUG=

Review URL: https://codereview.chromium.org/1056663005

Cr-Commit-Position: refs/heads/master@{#27583}

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1053583005

Cr-Commit-Position: refs/heads/master@{#27582}

BUG=v8:3539
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1029093002

Cr-Commit-Position: refs/heads/master@{#27581}

BUG=v8:3996
LOG=y
R=dslomov@chromium.org,kbr@chromium.org,hpayer@chromium.org

Review URL: https://codereview.chromium.org/1041403003

Cr-Commit-Position: refs/heads/master@{#27580}

BUG=none
R=danno@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/960903003

Cr-Commit-Position: refs/heads/master@{#27579}

Currently, this doesn't really help to generate better code,
nevertheless this is the right thing to do. When our type system(s)
are fixed, this should avoid falling back to floating point operations
in various cases.

Review URL: https://codereview.chromium.org/1057813002

Cr-Commit-Position: refs/heads/master@{#27578}

  language/asi/S7.9_A5.7_T1

http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3024/steps/Test262-es6/logs/S7.9_A5.7_T1

This looks suspicious. Maybe the monkeyYaml is the reason for this?

BUG=None
TBR=adamk

Review URL: https://codereview.chromium.org/1052083002

Cr-Commit-Position: refs/heads/master@{#27577}

BUG=None
LOG=N
R=adamk, rossberg

Review URL: https://codereview.chromium.org/1052013002

Cr-Commit-Position: refs/heads/master@{#27576}

BUG=

Review URL: https://codereview.chromium.org/1052653003

Cr-Commit-Position: refs/heads/master@{#27575}

Could not encode the large slot number in opcode MiscField.

TEST=mozilla/js/tests/js1_5/Regress/regress-396684.js
BUG=

Review URL: https://codereview.chromium.org/1043393002

Cr-Commit-Position: refs/heads/master@{#27574}

R=vogelheim@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1049383004

Cr-Commit-Position: refs/heads/master@{#27573}

The /NativeError/ functions should have Error as their [[Prototype]].

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-properties-of-the-nativeerror-constructors

BUG=v8:3998
LOG=N
R=adamk, dslomov@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1049323003

Cr-Commit-Position: refs/heads/master@{#27572}

R=mstarzinger@chromium.org
BUG=v8:3976
BUG=472504
LOG=y

Review URL: https://codereview.chromium.org/1051833002

Cr-Commit-Position: refs/heads/master@{#27571}

As long as we still have to process global handles, the impact is not
yet worthwhile

BUG=v8:3862
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1050443002

Cr-Commit-Position: refs/heads/master@{#27570}

In ES6 Object.getOwnPropertyDescriptor should call ToObject, which
means that primitive values will return descriptors from the wrapper.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/998163004

Cr-Commit-Position: refs/heads/master@{#27569}

Revert of Remove promotion backup case and report OOM instead. (patchset #2 id:20001 of https://codereview.chromium.org/977013003/)

Reason for revert:
Spike in OOM crashes: crbug.com/403113

Original issue's description:
> Remove promotion backup case and report OOM instead.
>
> There are no test cases for this piece of code and it is really hard to test. If this rare case triggers, we are anyway in an OOM situation and would crash probably soon afterwards.
>
> BUG=
>
> Committed: https://crrev.com/e813afaf127ab80290153ab676dc07212bdc8946
> Cr-Commit-Position: refs/heads/master@{#27026}

TBR=mstarzinger@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1050113002

Cr-Commit-Position: refs/heads/master@{#27568}

The removed assertion consistently passes not because the invoked
`close` method internally throws a `TypeError` but because the `close`
method does not exist. The ES6 specification does not define a `close`
method on the GeneratorPrototype, so this test is a tautology.

BUG=None
LOG=N
R=arv

Review URL: https://codereview.chromium.org/1046963002

Cr-Commit-Position: refs/heads/master@{#27567}

The modified assertions targeted the property descriptor for the
template object's first "cooked" value. The code immediately preceeding
these statements asserts these values.

Update the assertions to instead target the property descriptor for the
template object's first "raw" value (which are otherwise untested).

BUG=

Review URL: https://codereview.chromium.org/1049523003

Cr-Commit-Position: refs/heads/master@{#27566}

Revert of Add CHECKs  when updating pointers from the slots and store buffers (patchset #3 id:40001 of https://codereview.chromium.org/1035763002/)

Reason for revert:
Got one dev-channel with this. Should be enough.

Original issue's description:
> Add CHECKs  when updating pointers from the slots and store buffers
>
> We want to verify that we always overwrite heap objects with heap
> objects, and non-heap objects with non-heap objects
>
> BUG=chromium:452095
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/58fbcfac8ae82b1241f07e1b8ea81a5973514c11
> Cr-Commit-Position: refs/heads/master@{#27479}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:452095

Review URL: https://codereview.chromium.org/1052713002

Cr-Commit-Position: refs/heads/master@{#27565}

Revert of Correctly compute line numbers in functions from the function constructor. (patchset #5 id:80001 of https://codereview.chromium.org/701093003/)

Reason for revert:
Locations from New Function are broken in DevTools.

Original issue's description:
> Correctly compute line numbers in functions from the function constructor.
>
> R=aandrey@chromium.org
> BUG=chromium:109362
> LOG=Y
>
> Committed: https://code.google.com/p/v8/source/detail?r=25289

TBR=aandrey@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/1053563002

Cr-Commit-Position: refs/heads/master@{#27564}