Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
and %HasProperty anyway, and cannot be optimized, plus it had a weird
special fast case (which also involved at least one LOAD_IC plus some
intrinsic magic).

R=yangguo@chromium.org,jarin@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel

Committed: https://crrev.com/72d60a1e80e81e2e68ca402665e2acbc46c5e471
Cr-Commit-Position: refs/heads/master@{#30154}

Review URL: https://codereview.chromium.org/1295433002

Cr-Commit-Position: refs/heads/master@{#30582}

The last changes for vector store functionality, they are in 3 areas:

1) The new vector [keyed] store code stubs - implementation.
2) IC and handler compiler adjustments
3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.

TBR=bmeurer@chromium.org, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1319123004

Cr-Commit-Position: refs/heads/master@{#30581}

If the range doesn't have calls, but still fails to allocate, try and find a split
position outside a loop.

BUG=

Review URL: https://codereview.chromium.org/1301393012

Cr-Commit-Position: refs/heads/master@{#30580}

Once  a range is found to have a conflict, split around all the calls it
crosses over, since it will anyway have conflicts there, too.

Incrementally, from the last change to greedy, this change brings
overall improvement in benchmarks. In fact, except for 2 regressions
in Jetstream (splay-latency and date-format-xparb, at 6 and 7%
respectivelly), everything else is in the green or noise. Quite a few
benchmarks are over 3%, with a few (zlib, for example) in the double
digits.

Review URL: https://codereview.chromium.org/1328783002

Cr-Commit-Position: refs/heads/master@{#30579}

Rolling v8/build/gyp to 2b17e0b26a93e8c9758c23aec6c554da4ca8f0a9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1305273008

Cr-Commit-Position: refs/heads/master@{#30578}

This is uncontroversial the dead code removal part of
https://codereview.chromium.org/1307943013, which was
previously landed, but got reverted because of DOM
breakage that requires more investigation.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1322843005

Cr-Commit-Position: refs/heads/master@{#30577}

Port 8a378f46

Original commit message:
    This turns the has_instance_call_handler bit on Map into an is_callable
    bit, that matches the spec definition of IsCallable (i.e. instances have
    [[Call]] internal methods).

    Also fix the typeof operator to properly say "function" for everything
    that is callable.

    Also remove the (unused) premature %_GetPrototype optimization from
    Crankshaft, which just complicated the Map bit swap.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1330613005

Cr-Commit-Position: refs/heads/master@{#30576}

Port 72bc4b5c

Original commit message:
    Use a single JSIteratorResult type for all implementation provided
    iterator results (i.e. the String, Array and collection iterators,
    and also for generators).  This removes one source of unnecessary
    polymorphism in for-of loops.  It is accomplished by a new intrinsic
    %_CreateIterResultObject() that should be used to create iterator
    result objects from JavaScript builtins (there's a matching factory
    method for C++ code).

    Also restructure the %StringIteratorPrototype%.next() and
    %ArrayIteratorPrototype%.next() functions to be a bit more friendly
    to optimizing compilers.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1325203004

Cr-Commit-Position: refs/heads/master@{#30575}

Port 510baeac

Original commit message:
    Kills the kRestParameter bailout/disabled optimization, and fixes
    lazily parsed arrow functions with rest parameters.

    Supercedes https://crrev.com/1235153006/

R=caitpotter88@gmail.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:508074, v8:2160, v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1318523006

Cr-Commit-Position: refs/heads/master@{#30574}

 - Print the summary excluding other tick information
 - Add test to verify that summary is printed correctly.

BUG=None
LOG=N

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1318933004

Cr-Commit-Position: refs/heads/master@{#30573}

Port 72bc4b5c

Original commit message:
Use a single JSIteratorResult type for all implementation provided
iterator results (i.e. the String, Array and collection iterators,
and also for generators).  This removes one source of unnecessary
polymorphism in for-of loops.  It is accomplished by a new intrinsic
%_CreateIterResultObject() that should be used to create iterator
result objects from JavaScript builtins (there's a matching factory
method for C++ code).

Also restructure the %StringIteratorPrototype%.next() and
%ArrayIteratorPrototype%.next() functions to be a bit more friendly
to optimizing compilers.

BUG=

Review URL: https://codereview.chromium.org/1315903005

Cr-Commit-Position: refs/heads/master@{#30572}

Revert of Vector ICs: platform support for vector-based stores. (patchset #7 id:120001 of https://codereview.chromium.org/1328603003/ )

Reason for revert:
[Sheriff] Breaks compile on arm:
http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20builder/builds/6590

Original issue's description:
> Vector ICs: platform support for vector-based stores.
>
> The last changes for vector store functionality, they are in 3 areas:
>
> 1) The new vector [keyed] store code stubs - implementation.
> 2) IC and handler compiler adjustments
> 3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.
>
> BUG=
>
> Committed: https://crrev.com/63af1b3aec6547e7cdf502666ff79c562de8b679
> Cr-Commit-Position: refs/heads/master@{#30570}

TBR=bmeurer@chromium.org,jkummerow@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1303053004

Cr-Commit-Position: refs/heads/master@{#30571}

The last changes for vector store functionality, they are in 3 areas:

1) The new vector [keyed] store code stubs - implementation.
2) IC and handler compiler adjustments
3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.

BUG=

Review URL: https://codereview.chromium.org/1328603003

Cr-Commit-Position: refs/heads/master@{#30570}

This reverts commit b06a6a89.

BUG=chromium:519319,chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1311993003

Cr-Commit-Position: refs/heads/master@{#30569}

Revert of [es5] Class of object is "Function" if object has [[Call]]. (patchset #3 id:40001 of https://codereview.chromium.org/1307943013/ )

Reason for revert:
[Sheriff] Changes several layout test expectations. Please fix upstream first if intended. E.g.:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/1729

Several lines change from PASS to FAIL.

Original issue's description:
> [es5] Class of object is "Function" if object has [[Call]].
>
> The concept of class was mostly removed from ES6, but we still use the
> class of objects to distinguish object kinds in our builtins.  So update
> this to be in sync with IsCallable (thereby getting rid of the previous
> instance type based tests for callable things completely).
>
> R=jarin@chromium.org, jkummerow@chromium.org
>
> Committed: https://crrev.com/af778389947f1b01fb036756ea3cb8ed8ab98452
> Cr-Commit-Position: refs/heads/master@{#30566}

TBR=jarin@chromium.org,jkummerow@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1306303005

Cr-Commit-Position: refs/heads/master@{#30568}

This relands https://codereview.chromium.org/1303183005

BUG=chromium:515782
LOG=n
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1330623002

Cr-Commit-Position: refs/heads/master@{#30567}

The concept of class was mostly removed from ES6, but we still use the
class of objects to distinguish object kinds in our builtins.  So update
this to be in sync with IsCallable (thereby getting rid of the previous
instance type based tests for callable things completely).

R=jarin@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1307943013

Cr-Commit-Position: refs/heads/master@{#30566}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1307203005

Cr-Commit-Position: refs/heads/master@{#30565}

While we may have consecutive deferred blocks, they may be entered
from other blocks that are not predecessors of the first block. Same
for the last block and exiting. So the total set of live ranges within
the given set of blocks is the union of the individual in and out live
sets.

This is a performance bug, not a functional bug.

BUG=

Review URL: https://codereview.chromium.org/1322703003

Cr-Commit-Position: refs/heads/master@{#30564}

BUG=chromium:524425
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1325173003

Cr-Commit-Position: refs/heads/master@{#30563}

Follow up on discussion of https://codereview.chromium.org/1310503006/

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1313953008

Cr-Commit-Position: refs/heads/master@{#30562}

Fixed ranges don't have operands assigned, for example.

BUG=

Review URL: https://codereview.chromium.org/1326643006

Cr-Commit-Position: refs/heads/master@{#30561}

{AtomicValue}: A simple integer value that can be atomically
read/set/incremented.

{AtomicEnumSet}: Similar to EnumSet this set basically represents an atomic
bitfield based on enums. Atomic operations guarantee that setting one bit does
not race with setting other bits.

{AtomicEnumFlag}: A flag that is based on an enum that can be read and
(attempted to be) changed atomically.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1310993004

Cr-Commit-Position: refs/heads/master@{#30560}

BUG=

Review URL: https://codereview.chromium.org/1312893010

Cr-Commit-Position: refs/heads/master@{#30559}

Revert of Automatically download gold plugin for cfi builds. (patchset #1 id:1 of https://codereview.chromium.org/1303183005/ )

Reason for revert:
Breaks windows.

Original issue's description:
> Automatically download gold plugin for cfi builds.
>
> BUG=chromium:515782
> LOG=n
> NOTRY=true
>
> Committed: https://crrev.com/c8dbd2c477c47a34593a0e7deee55915425b4ac2
> Cr-Commit-Position: refs/heads/master@{#30556}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:515782

Review URL: https://codereview.chromium.org/1329653004

Cr-Commit-Position: refs/heads/master@{#30558}

Use a single JSIteratorResult type for all implementation provided
iterator results (i.e. the String, Array and collection iterators,
and also for generators).  This removes one source of unnecessary
polymorphism in for-of loops.  It is accomplished by a new intrinsic
%_CreateIterResultObject() that should be used to create iterator
result objects from JavaScript builtins (there's a matching factory
method for C++ code).

Also restructure the %StringIteratorPrototype%.next() and
%ArrayIteratorPrototype%.next() functions to be a bit more friendly
to optimizing compilers.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1302173007

Cr-Commit-Position: refs/heads/master@{#30557}

BUG=chromium:515782
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1303183005

Cr-Commit-Position: refs/heads/master@{#30556}

This is to support WebAssembly 64-bit ints in the short term, since it
currently uses CheckedLoad/CheckedStore for accesses to the memory. In the
long run, we'll change this to be explicit bounds checks that throw on out
of bounds.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1310323006

Cr-Commit-Position: refs/heads/master@{#30555}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1318863004

Cr-Commit-Position: refs/heads/master@{#30554}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1327523003

Cr-Commit-Position: refs/heads/master@{#30553}

This turns the has_instance_call_handler bit on Map into an is_callable
bit, that matches the spec definition of IsCallable (i.e. instances have
[[Call]] internal methods).

Also fix the typeof operator to properly say "function" for everything
that is callable.

Also remove the (unused) premature %_GetPrototype optimization from
Crankshaft, which just complicated the Map bit swap.

R=mstarzinger@chromium.org, rossberg@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg

Review URL: https://codereview.chromium.org/1316933002

Cr-Commit-Position: refs/heads/master@{#30552}

Rolling v8/tools/clang to 91e7a78800b5849e27e098daa42e6ae8650ad322

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1316403006

Cr-Commit-Position: refs/heads/master@{#30551}

Kills the kRestParameter bailout/disabled optimization, and fixes
lazily parsed arrow functions with rest parameters.

Supercedes https://crrev.com/1235153006/

BUG=chromium:508074, v8:2160, v8:2700
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1272673003

Cr-Commit-Position: refs/heads/master@{#30550}

Add methods for converting parameter index to a register and vice-versa.

Move Register class into bytecodes.h.

Update Bytecodes::Decode to pretty print parameters.

BUG=v8:4280
LOG=NO

Review URL: https://codereview.chromium.org/1325983002

Cr-Commit-Position: refs/heads/master@{#30549}

This is a follow-up to a previous change and moved object statistics
tracking into its own component. It is no longer intertwinded with the
normal marking logic, but separated out into ObjectStatsVisitor.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1310953008

Cr-Commit-Position: refs/heads/master@{#30548}

Note that this is only pulling out the bookkeeping side of things, the
marking visitor that actually records the statistics should also move
into the ObjectStats class. That will be done as a follow-up.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1326793002

Cr-Commit-Position: refs/heads/master@{#30547}

- Use the new ElementsAccessor methods
- improve test coverage

BUG=

Review URL: https://codereview.chromium.org/1317053006

Cr-Commit-Position: refs/heads/master@{#30546}

Port c29a4061

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1325103003

Cr-Commit-Position: refs/heads/master@{#30545}

Code::WipeOutHeader now nulls out the next code link to avoid
embedding that address in snapshot.

BUG=
LOG=NO

Review URL: https://codereview.chromium.org/1310503006

Cr-Commit-Position: refs/heads/master@{#30544}

Adds support for property load operations via Load/KeyedLoad ICs. Adds the
following bytecodes:
 - LoadIC
 - KeyedLoadIC
Also adds support to the interpreter assembler for loading the type feedback
vector from the function on the stack, and calling ICs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1309843007

Cr-Commit-Position: refs/heads/master@{#30543}