Revert "Revert of [turbofan] Splinter into one range.
(patchset #2 id:80001 of https://codereview.chromium.org/1391023007/ )"

This reverts commit 23a8837f.

Also added a CHECK in Merge to validate that splitting yields a different
range and thus advances the algorithm. Ran stress bots successfully. Likely my earlier change in Splintering addressed the stress test scenario
that was looping infinitely.

BUG=

Review URL: https://codereview.chromium.org/1406983004

Cr-Commit-Position: refs/heads/master@{#31430}

Rolling v8/build/gyp to 3f21260b43401553c37bb28090b65a75577d5b4e

Rolling v8/tools/swarming_client to b64f0423ee66e730b0ceb88de8b9b89a98d7b61a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1417863002

Cr-Commit-Position: refs/heads/master@{#31429}

Adds an implementation of "do expression" parsing (https://webcache.googleusercontent.com/search?q=cache:MIGALjqPDNgJ:wiki.ecmascript.org/doku.php%3Fid%3Dstrawman:do_expressions+&cd=1&hl=en&ct=clnk&gl=us).

This feature provides a way to evaluate a block of statements within an expression context, producing the resulting completion value. This is very helpful for implementing certain language features via desugaring.

BUG=v8:4488
LOG=N
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1399893002

Cr-Commit-Position: refs/heads/master@{#31428}

This change defines a common config for clients of v8 that
need to define V8_USE_EXTERNAL_STARTUP_DATA in order for
client code to be compiled correctly.

R=brettw@chromium.org, jochen@chromium.org
BUG=541791
LOG=n

Review URL: https://codereview.chromium.org/1415773003

Cr-Commit-Position: refs/heads/master@{#31427}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1408033003

Cr-Commit-Position: refs/heads/master@{#31426}

TBR=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413223007

Cr-Commit-Position: refs/heads/master@{#31425}

Revert of Use C++ implementation of Object.definePropert{y,ies} (patchset #4 id:60001 of https://codereview.chromium.org/1409613004/ )

Reason for revert:
[Sheriff] Breaks layout tests. Please request rebase upstream first if intended:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2427

One test times out now.

Original issue's description:
> Use C++ implementation of Object.definePropert{y,ies}
>
> For now, only rewire builtins in v8natives.js to call the new runtime functions.
>
> Committed: https://crrev.com/b2abc0e3ad4ce9dde8d66aab7aafae179e6948d4
> Cr-Commit-Position: refs/heads/master@{#31413}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1412893005

Cr-Commit-Position: refs/heads/master@{#31424}

R=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412573005

Cr-Commit-Position: refs/heads/master@{#31423}

range's internal structure, we take a range at a time and splinter based on
the blocks it covers. This is no different in scenarios where a UseInterval
covers non-deferred then deferred blocks. However, in scenarios where
a deferred block jumps to another one, and there are no other blocks
covered by the range in between, this CL will treat the two such blocks
together, while the previous one would treat them separately. This matters
in cases such as deoptimization blocks preceded (not necessarily
consecutively) by a single instruction (jump) Merging block.

Review URL: https://codereview.chromium.org/1415833002

Cr-Commit-Position: refs/heads/master@{#31422}

It is not always safe to allocate new heap objects in the JSGraph. We
might have to revisit this later once we do the canonicalization for
HeapConstants.

R=jarin@chromium.org
BUG=chromium:545364
LOG=n

Review URL: https://codereview.chromium.org/1413373002

Cr-Commit-Position: refs/heads/master@{#31421}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1420543002

Cr-Commit-Position: refs/heads/master@{#31420}

R=jkummerow@chromium.org
BUG=

Committed: https://crrev.com/52225f39df578e77b4804506ca4bc15e096f5cab
Cr-Commit-Position: refs/heads/master@{#31252}

Committed: https://crrev.com/31487015de401892b4d12b5faef0c47c201308da
Cr-Commit-Position: refs/heads/master@{#31305}

Review URL: https://codereview.chromium.org/1396523005

Cr-Commit-Position: refs/heads/master@{#31419}

Skip only for simulator runs.

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1418593005

Cr-Commit-Position: refs/heads/master@{#31418}

This reverts commit 24aca870.

The API makes these values appear to be per-isolate, when in fact
they are per-context. Installing the results of these on Template
objects instantiated in multiple contexts can result in security
violations and contexts being retained indefinitely.

An alternative mechanism for using these in a sensible way is
provided by https://crrev.com/1409593002

BUG=
LOG=N
R=jochen@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1415663002

Cr-Commit-Position: refs/heads/master@{#31417}

This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}

The problem is that the gc pattern is different, and the list of debug scripts
may have more or less duplicates than before. The solution is to just turn off
--stress-opt for the test.

R=yangguo@chromium.org
BUG=v8:4502
LOG=N

Review URL: https://codereview.chromium.org/1416883002

Cr-Commit-Position: refs/heads/master@{#31415}

BUG=chromium:534746
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1410333004

Cr-Commit-Position: refs/heads/master@{#31414}

For now, only rewire builtins in v8natives.js to call the new runtime functions.

Review URL: https://codereview.chromium.org/1409613004

Cr-Commit-Position: refs/heads/master@{#31413}

R=bmeurer@chromium.org
TEST=mjsunit/harmony/reflect --exhaustive-variants
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414263002

Cr-Commit-Position: refs/heads/master@{#31412}

Use the simple inline function version of {Min, Max} where possible to
improve performance

Now uses an forced inline js function instead of a python macro
to avoid expressions be evaluated twice

Follow-up to CR: https://codereview.chromium.org/1331993004

Review URL: https://codereview.chromium.org/1410473002

Cr-Commit-Position: refs/heads/master@{#31411}

Review URL: https://codereview.chromium.org/1405363003

Cr-Commit-Position: refs/heads/master@{#31410}

Review URL: https://codereview.chromium.org/1402353006

Cr-Commit-Position: refs/heads/master@{#31409}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1417583003

Cr-Commit-Position: refs/heads/master@{#31408}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1416863002 .

Cr-Commit-Position: refs/heads/master@{#31407}

This stages the general purpose inlining mechanism in TurboFan and
also disables the remaining tests that still fail. We do this to get
test coverage early and to avoid regressing inlining as we go along.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419623002

Cr-Commit-Position: refs/heads/master@{#31406}

This fixes JSNativeContextSpecialization to not lower JSLoadGlobal and
JSStoreGlobal nodes if the global variable has morphed into a context
variable that is currently within a TDZ. Scary variable binding is being
scary!

R=bmeurer@chromium.org
TEST=cctest/test-decls/Regress3941 --turbo-filter="f"
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1415733003

Cr-Commit-Position: refs/heads/master@{#31405}

Revert of [es6] Fix scoping for default parameters in arrow functions (patchset #5 id:80001 of https://codereview.chromium.org/1405313002/ )

Reason for revert:
Breaks nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2407/steps/Check/logs/regress-4395

Original issue's description:
> [es6] Fix scoping for default parameters in arrow functions
>
> When eagerly parsing arrow functions, expressions in default
> parameter initializers are parsed in the enclosing scope,
> rather than in the function's scope (since that scope does not
> yet exist). This leads to VariableProxies being added to the
> wrong scope, and scope chains for FunctionLiterals being incorrect.
>
> This patch addresses these problems by adding a subclass of
> AstExpressionVisitor that moves VariableProxies to the proper
> scope and fixes up scope chains of FunctionLiterals.
>
> More work likely still needs to be done to make this work completely,
> but it's very close to correct.
>
> BUG=v8:4395
> LOG=y
>
> Committed: https://crrev.com/cf72aad39e51de9b7074ea039377c1812f4a2c6b
> Cr-Commit-Position: refs/heads/master@{#31402}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4395

Review URL: https://codereview.chromium.org/1417463004

Cr-Commit-Position: refs/heads/master@{#31404}

This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}

When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1405313002

Cr-Commit-Position: refs/heads/master@{#31402}

We need to use the ReturnId for calls, otherwise lazy bailout will not
work correctly in case of inlining.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407953004

Cr-Commit-Position: refs/heads/master@{#31401}

BUG=chromium:544774
LOG=n

Review URL: https://codereview.chromium.org/1409023004

Cr-Commit-Position: refs/heads/master@{#31400}

This fixes the bailout point used by JSCreateScriptContext nodes for
top-level code. The bailout point differs from the Crankshaft one as
parameter slots have not been copied and the context chain was not
extended yet in TurboFan. Hence a new bailout id is required.

R=ishell@chromium.org
TEST=cctest/test-decls/CrossScript --turbo-inlining

Review URL: https://codereview.chromium.org/1413933005

Cr-Commit-Position: refs/heads/master@{#31399}

Revert of [es6] stage sticky regexps and RegExp.prototype.flags. (patchset #3 id:40001 of https://codereview.chromium.org/1412133002/ )

Reason for revert:
[sheriff] breaks nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/4816

Original issue's description:
> [es6] stage sticky regexps and RegExp.prototype.flags.
>
> R=littledan@chromium.org
> BUG=v8:4342
> LOG=Y
>
> Committed: https://crrev.com/722719fe31fe7fd5bb50be6256b3581bb28a8169
> Cr-Commit-Position: refs/heads/master@{#31390}

TBR=littledan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4342

Review URL: https://codereview.chromium.org/1403283004

Cr-Commit-Position: refs/heads/master@{#31398}

BUG=

Review URL: https://codereview.chromium.org/1410713006

Cr-Commit-Position: refs/heads/master@{#31397}

NOTRY=true
TBR=mbrandy@us.ibm.com

Review URL: https://codereview.chromium.org/1411993004

Cr-Commit-Position: refs/heads/master@{#31396}

The boards on the bots do not have FPU, and therefore time out on
this test.

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1411313003

Cr-Commit-Position: refs/heads/master@{#31395}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1415463004

Cr-Commit-Position: refs/heads/master@{#31394}

Revert "[turbofan] Stage --turbo-inlining behind --turbo flag." and "[turbofan] Skip more tests that fail with --turbo-inlining."

This reverts commit 019f9408,
6ed05f44 and
e34c343d.

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1413183004 .

Cr-Commit-Position: refs/heads/master@{#31393}

The debugger calls PromiseHasUserDefinedRejectHandler to recursively search the
tree of dependent promises for user-defined reject handlers. If no such reject
handler exists, rejecting the promise is considered an uncaught exception.

Promise.race and Promise.all interupt the link of promise dependency wrt the
search. This change fixes that link.

R=rossberg@chromium.org
BUG=chromium:439585
LOG=N

Review URL: https://codereview.chromium.org/1411083003

Cr-Commit-Position: refs/heads/master@{#31392}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1416663004

Cr-Commit-Position: refs/heads/master@{#31391}