Adds support for calling runtime functions from the interpreter. Adds the
CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
and the arguments in sequential registers. Adds a InterpreterCEntry builtin
to enable the interpreter to enter C++ code based on the functionId.

Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
and groups all the interpreter builtins together.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1362383002

Cr-Commit-Position: refs/heads/master@{#31064}

BUG=

Review URL: https://codereview.chromium.org/1370353003

Cr-Commit-Position: refs/heads/master@{#31063}

Rolling v8/third_party/icu to 94e4b770ce2f6065d4261d29c32683a6099b9d93

Rolling v8/tools/swarming_client to e4c0e242eeec361886ed2b89591a505ebe24db43

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1383963002

Cr-Commit-Position: refs/heads/master@{#31062}

Swarming won't support an incremental data file. By just
sorting the lowest hanging fruits to the beginning we
already get a big bang for the buck (>80% of the improvement
we get otherwise).

This will require semi-regular manual updates of the
slowest tests.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1385443002

Cr-Commit-Position: refs/heads/master@{#31061}

Review URL: https://codereview.chromium.org/1378253002

Cr-Commit-Position: refs/heads/master@{#31060}

Disable vector store ICs for mjsunit/call-counts because slot indices change when --vector-stores is enabled.

Review URL: https://codereview.chromium.org/1381073003

Cr-Commit-Position: refs/heads/master@{#31059}

Adds support for short operands, starting with kIdx16. Introduces
BytecodeTraits to enable compile time determination of various traits for a
bytecode, such as size, operands, etc. Reworks BytecodeIterator,
BytecodeArrayBuilder and Bytecodes::Decode to support 16 bit operands. Adds
support to Interpreter to load 16 bit operands.

Also fixes a bug with ToBoolean where it wouldn't get emitted at the start
of a block, and added a test.

BytecodeTraits template magic inspired by oth@chromium.org.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1370893002

Cr-Commit-Position: refs/heads/master@{#31058}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1377423002

Cr-Commit-Position: refs/heads/master@{#31057}

It was supposed to be used by the CPU profiler. But as long as
these ranges are not built when profiler is not running, once
the profiler is started there're no ranges for already compiled
functions. So basically this code never worked.

As long as now CPU profiler uses another approach this code is no
longer needed.

Review URL: https://codereview.chromium.org/1376333003

Cr-Commit-Position: refs/heads/master@{#31056}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1378343002

Cr-Commit-Position: refs/heads/master@{#31055}

Introduce %_ToNumber intrinsic, which just calls to the existing
ToNumberStub, and remove all uses of our custom JavaScript plus
intrinsics based ToNumber and friends.

Also replace the TO_NUMBER_INLINE macro with TO_NUMBER,
which is currently a wrapper for %_ToNumber. Newly written JS
code should use TO_NUMBER (similar to TO_STRING, TO_INT32,
and friends).

Also finally remove the DefaultString/DefaultNumber builtins, which
are basically the ES5 version of ToPrimitive. Now all code uses the
ES6 version, which is implemented in Object::ToPrimitive and
JSReceiver::ToPrimitive in C++.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1384443002

Cr-Commit-Position: refs/heads/master@{#31054}

This feature is no longer needed because of the autotag bot.

NOTRY=true
LOG=N
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1384523002

Cr-Commit-Position: refs/heads/master@{#31053}

Improve bytecode generation for if when there's no else clause.

Display target addresses for jump instructions in
Bytecode::Disassemble().

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1373903005

Cr-Commit-Position: refs/heads/master@{#31052}

R=rossberg
BUG=v8:2529
LOG=Y

Review URL: https://codereview.chromium.org/1375203004

Cr-Commit-Position: refs/heads/master@{#31051}

This CL also allows to use arbitrary number of feedback vector elements for particular slot kind.

Review URL: https://codereview.chromium.org/1370303004

Cr-Commit-Position: refs/heads/master@{#31050}

Avoid hard-coding expected parameter indices.  These depend on the
frame size which can vary (e.g. if embedded constant pools are
enabled).

R=oth@chromium.org, rmcilroy@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1375373002

Cr-Commit-Position: refs/heads/master@{#31049}

BUG=

Review URL: https://codereview.chromium.org/1377723003

Cr-Commit-Position: refs/heads/master@{#31048}

NOTRY=true
LOG=N
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1369213003

Cr-Commit-Position: refs/heads/master@{#31047}

This is a simplified version of chromium's isolate driver:
- 'prepare' will create a *.isolate.gen.json with the
arguments to be used later.
- other modes will just be passed through to the isolate
script.

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1378133005

Cr-Commit-Position: refs/heads/master@{#31046}

Port https://codereview.chromium.org/1154633003/

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1380983002

Cr-Commit-Position: refs/heads/master@{#31045}

We need to do other things with this bindings object, like store a feedback vector. Therefore, it's a good time to wrap it up in a helper class.

BUG=

Review URL: https://codereview.chromium.org/1369293003

Cr-Commit-Position: refs/heads/master@{#31044}

With this change mergeinfo.py gets more useful. There is
a distinction between merges and follow-up CLs/ports/reverts.

Also the information is show if the commit is already
rolled/an lkgr/deployed to Canary channel.

Additionally some formatting errors were resolved and
the already existing git wrapper used.

LOG=N
R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1341303002

Cr-Commit-Position: refs/heads/master@{#31043}

Var-bindings may shadow parameters from a non-simple parameter list. When that happens: they create separate bindings, but are initialised with the respective parameter value. Thus:

(function(x, f = () => x) { var x; var y = x; x = 2; return [x, y, f()] })(1) -->  [2, 1, 1]

This CL implements that by inserting a suitable assignment for every shadwowing var-variable (e.g., x = outer_x above) at the beginning of the function's body block.

R=adamk@chromium.org
BUG=v8:4440,v8:811
LOG=N

Review URL: https://codereview.chromium.org/1371333004

Cr-Commit-Position: refs/heads/master@{#31042}

This is in preparation of implementing ES6 completion semantics and
depends on #1362333002.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1362363002

Cr-Commit-Position: refs/heads/master@{#31041}

- Wasted bytes are now accounted where they accrue, i.e., the corresponding free
  list. The amount of waste is transferred by concatenating free lists.
- During concatenation, free lists are no longer locked on FreeListCategory
  level, but in the FreeList itself, simplifying the sync between contained nodes
  and wasted bytes (which are effectively dropped nodes).

This is pre-work for properly moving memory to compaction spaces, which requires
correct accounting of wasted memory.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1379833002

Cr-Commit-Position: refs/heads/master@{#31040}

R=ishell@chromium.org
BUG=chromium:536790
LOG=N

Review URL: https://codereview.chromium.org/1375913002

Cr-Commit-Position: refs/heads/master@{#31039}

Rolling v8/buildtools to 0c88009d5c50b9f21b6f8849db08abfb9eb29f1e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1381873002

Cr-Commit-Position: refs/heads/master@{#31038}

The ES2015 spec is missing an extension of sloppy-mode block-scoped function
behavior to the global scope in scripts, as well as to eval. This patch
brings that hoisting to those two areas. The behavior is not perfectly
spec-compliant since properties created on the global scope should be
set as enumerable even if they are non-enumerable previously, but the
attributes will not be modified if the property already exists under
this patch.

BUG=v8:4441
LOG=Y
R=adamk
TEST=reddit comment functionality seems to be fixed

Review URL: https://codereview.chromium.org/1376623002

Cr-Commit-Position: refs/heads/master@{#31037}

Port c90c60ba

Original commit message:
    Make sure to always reference it indirectly. This allows us to make the vector
    native-context dependent should we wish.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1381803002

Cr-Commit-Position: refs/heads/master@{#31036}

Port d8cdd695

Original commit message:
    The LiteralsArray will soon hold a type feedback vector. Code treats it as an
    ordinary fixed array, and needs to stop that.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1373823003

Cr-Commit-Position: refs/heads/master@{#31035}

Port 09626525

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1377133005

Cr-Commit-Position: refs/heads/master@{#31034}

Port 9b12ec9a

Original commit message:
    This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for
    help with materializing arguments objects when possible. Along the way
    this changes the calling convention of said stub to take parameters in
    registers instead of on the stack.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1376303002

Cr-Commit-Position: refs/heads/master@{#31033}

- No need to call AsVariableProxy() on a VariableProxy
- Reduce AST visitor boilerplate using pre-existing macro
  (and re-alphabetize the list of non-patterns).

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1376633005

Cr-Commit-Position: refs/heads/master@{#31032}

Arrow functions have been enabled by default since the 4.5 branch.

Review URL: https://codereview.chromium.org/1373633002

Cr-Commit-Position: refs/heads/master@{#31031}

Besides matching the spec, this matches the behavior of Firefox and Edge.

BUG=v8:3699
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1377603006

Cr-Commit-Position: refs/heads/master@{#31030}

The current implemention breaks sloppy mode code that uses function
declarations inside blocks at top-level. Work is ongoing on a patch
to fix this issue, but in the meantime it seems reasonable to move
the feature out of staging.

Manual revert of commit 6e07f5a7.

R=littledan@chromium.org
BUG=chromium:535836
LOG=y

Review URL: https://codereview.chromium.org/1375213005

Cr-Commit-Position: refs/heads/master@{#31029}

Added ScopeDetails.name field for closure scopes. It contains function's debug name of current context of scope.

BUG=493156
LOG=Y
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1375813002

Cr-Commit-Position: refs/heads/master@{#31028}

Port 8fe3ac07

Original commit message:
    There was already a bit on the Map named "function with prototype",
    which basically meant that the Map was a map for a JSFunction that could
    be used as a constructor. Now this CL generalizes that bit to
    IsConstructor, which says that whatever (Heap)Object you are looking at
    can be used as a constructor (i.e. the bit is also set for bound
    functions that can be used as constructors and proxies that have a
    [[Construct]] internal method).

    This way we have a single chokepoint for IsConstructor checking, which
    allows us to get rid of the various ways in which we tried to guess
    whether something could be used as a constructor or not.

    Drive-by-fix: Renamed IsConstructor on FunctionKind to
    IsClassConstructor to resolve the weird name clash, and the
    IsClassConstructor name also matches the spec.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4413, v8:4430
LOG=n

Review URL: https://codereview.chromium.org/1382673002

Cr-Commit-Position: refs/heads/master@{#31027}

Port 556b522a

Original commit message:
    We somehow try to push some stuff on the stack when we detect a stack
    overflow, that we don't need. Even worse we might access outside the
    valid stack bounds. Since we don't need this, it's gone.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:534881
LOG=n

Review URL: https://codereview.chromium.org/1382633002

Cr-Commit-Position: refs/heads/master@{#31026}

Port 634d1d86

Original commit message:
    Now both Execution::Call and Execution::New can deal with any
    kind of target and will raise a proper exception if the target is not
    callable (which is not yet spec compliant for New, as we would
    have to check IsConstructor instead, which we don't have yet).

    Now we no longer need to do any of these weird call/construct
    delegate gymnastics in C++, and we finally have a single true
    bottleneck for Call/Construct abstract operations in the code
    base, with only a few special handlings left in the compilers to
    optimize the JSFunction case.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4430, v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1374683006

Cr-Commit-Position: refs/heads/master@{#31025}