This solves a bug discovered with fast accessors, where a pre-age prologue
was written into a stub. Since StaticMarkingVisitor<.>::IsFlushable will
only flush Code::FUNCTION [1], we'll restrict GeneratePreagedPrologue to
functions, too, instead of adding a Code::STUB restriction.

Also, generalize api accessor test cases to --optimize-for-size.
Also, fix CompilationCacheCachingBehavior for --optimize-for-size.

[1] https://code.google.com/p/chromium/codesearch#chromium/src/v8/src/heap/objects-visiting-inl.h&l=629-632

R=epertoso
BUG=

Review URL: https://codereview.chromium.org/1580323003

Cr-Commit-Position: refs/heads/master@{#33291}

R=hablich@chromium.org
BUG=v8:4664
LOG=N

Review URL: https://codereview.chromium.org/1581423003

Cr-Commit-Position: refs/heads/master@{#33290}

Depot tools now uses the project's cq.cfg by default on
git cl try, if no other method is specified.

Based on:
https://codereview.chromium.org/1579423004/
https://codereview.chromium.org/1587893003/

BUG=chromium:565952
TBR=tandrii@chromium.org
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1583233002

Cr-Commit-Position: refs/heads/master@{#33289}

BUG=chromium:575080
LOG=N

Review URL: https://codereview.chromium.org/1579603002

Cr-Commit-Position: refs/heads/master@{#33288}

- Use valgrind from v8/third_party/valgrind fetched as custom
deps. This will make the check more portable on buildbot
slaves without the need to install valgrind.
- Build path to checked executable to be ready for swarming.

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1585093002

Cr-Commit-Position: refs/heads/master@{#33287}

Fix: pass global object as receiver when calling WASM->JS.

R=bradnelson@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1581393003

Cr-Commit-Position: refs/heads/master@{#33286}

Apparently, some StateValues have other StateValues as input. This
CL makes escape analysis transformation phase aware of it.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1581183004

Cr-Commit-Position: refs/heads/master@{#33285}

Revert of [cq] Keep presubmit trybots and cq automatically in sync. (patchset #1 id:1 of https://codereview.chromium.org/1580193004/ )

Reason for revert:
Doesn't work with triggered bots. Waiting for this fix: https://codereview.chromium.org/1587893003/

Original issue's description:
> [cq] Keep presubmit trybots and cq automatically in sync.
>
> Code copied 1:1 from chromium.
>
> BUG=chromium:565952
> LOG=n
> NOTRY=true
>
> Committed: https://crrev.com/039dce1e355be6422c672badef5f3895f3b16ead
> Cr-Commit-Position: refs/heads/master@{#33264}

TBR=tandrii@chromium.org,kjellander@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:565952

Review URL: https://codereview.chromium.org/1579223004

Cr-Commit-Position: refs/heads/master@{#33284}

Support inlining across bound functions in the JSCallReducer when we
specialize to the native context. This basically removes all overhead
from bound functions in TurboFan and gives another speed of 10x on my
microbenchmark.

BUG=chromium:535408, chromium:571299, v8:4629
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1581343002

Cr-Commit-Position: refs/heads/master@{#33283}

On Intel, xchg stalls the pipeline. We use xchg to implement swap
moves. In a separate exploration, the presence of xchg in a very hot
loop, due to a change in register allocation, lead to over 20% regression.

Simply changing that instruction with push/mov/pop (almost) eliminated
the regression.

In light of that, I removed uses of xchg. This leads to more instructions,
though. That is particularly problematic for long cycles, which, today,
we translate to successions of swaps.

I plan to address this cycle issue in a separate change. For now, the
goal is to unblock the initial work that lead here.

Review URL: https://codereview.chromium.org/1580233003

Cr-Commit-Position: refs/heads/master@{#33282}

Rolling v8/tools/clang to 24e8c1c92fe54ef8ed7651b5850c056983354a4a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1586933002

Cr-Commit-Position: refs/heads/master@{#33281}

  port 322ffda3 (r33265)

  original commit message:
  Also migrate the Number constructor to a native builtin, using the
  same mechanism already used by the String constructor. Otherwise just
  parsing and compiling the Number constructor to optimized code already
  eats 2ms on desktop for no good reason, and the resulting optimized
  code is not even close to awesome.

  Drive-by-fix: Use correct context for the [[Construct]] case of the
  String constructor as well, and share some code with it.

BUG=

Review URL: https://codereview.chromium.org/1581313002

Cr-Commit-Position: refs/heads/master@{#33280}

When parsing a pattern element with an assignment operator that is not
Token::ASSIGN, record a pattern error to indicate the invalid assignment target.

BUG=v8:811, v8:4666
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1583863003

Cr-Commit-Position: refs/heads/master@{#33279}

  port 12bcba15 (r33258)

  original commit message:
  The API functions are always in sloppy mode, so receiver is always a
  JSReceiver once the actual call trampoline runs, no need to check again
  in various places.

BUG=

Review URL: https://codereview.chromium.org/1582173002

Cr-Commit-Position: refs/heads/master@{#33278}

The bulk of these were marked simply '[PASS]', while one was marked
'[PASS, FAIL]' but seems to always pass.

BUG=v8:3305, v8:4405
LOG=n

Review URL: https://codereview.chromium.org/1584863003

Cr-Commit-Position: refs/heads/master@{#33277}

BUG=v8:3699
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1582783004

Cr-Commit-Position: refs/heads/master@{#33276}

Revert of [wasm] Add tests for JS wrappers to test-run-wasm. (patchset #1 id:1 of https://codereview.chromium.org/1581643004/ )

Reason for revert:
New test failed on nosnap builder (https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/4738):

Test: cctest/test-run-wasm-js/Run_CallJS_Add_jswrapped

Stderr:
abort: Sloppy function expects JSReceiver as receiver.

#
# Fatal error in ../../src/objects-inl.h, line 3221
# Check failed: !v8::internal::FLAG_enable_slow_asserts || (object->IsJSFunction()).
#

Original issue's description:
> [wasm] Add tests for JS wrappers to test-run-wasm.
>
> R=bradnelson@chromium.org, ahaas@chromium.org
> BUG=
>
> Committed: https://crrev.com/c52f5ced4e600a57c02301f2936b80f086613985
> Cr-Commit-Position: refs/heads/master@{#33274}

TBR=ahaas@chromium.org,bradnelson@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1587763002

Cr-Commit-Position: refs/heads/master@{#33275}

R=bradnelson@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1581643004

Cr-Commit-Position: refs/heads/master@{#33274}

Port 12bcba15

Original commit message:
    The API functions are always in sloppy mode, so receiver is always a
    JSReceiver once the actual call trampoline runs, no need to check again
    in various places.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583893002

Cr-Commit-Position: refs/heads/master@{#33273}

Port 322ffda3

Original commit message:
    Also migrate the Number constructor to a native builtin, using the
    same mechanism already used by the String constructor. Otherwise just
    parsing and compiling the Number constructor to optimized code already
    eats 2ms on desktop for no good reason, and the resulting optimized
    code is not even close to awesome.

    Drive-by-fix: Use correct context for the [[Construct]] case of the
    String constructor as well, and share some code with it.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1583903002

Cr-Commit-Position: refs/heads/master@{#33272}

exception operand in a handler block. This avoids confusing
unrelated ranges, which may happen if escape analysis elides
the exception operand.

BUG=chromium:576195
LOG=N

Review URL: https://codereview.chromium.org/1579603005

Cr-Commit-Position: refs/heads/master@{#33271}

The escape analysis transformation phase visits allocation nodes
twice under some circumstances, thus reporting wrong counter values.
This CL ensures counter values are correct.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1577273002

Cr-Commit-Position: refs/heads/master@{#33270}

Removes assignment hazard scope. Reverts back to the naive scheme of
allocating a temporary for every variable load. It was decided to revert it
because the current implementation does not handle logical expressions,
ternary operators, visiting objects in named/keyed loads. Also, we wanted
to evaluate alternate approaches and choose one when we have a mechanism
to measure performance.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1576403004

Cr-Commit-Position: refs/heads/master@{#33269}

Once we use type feedback, we need to reflect the feedback in the types, propagate
the new narrower types forward and use them in the subsequent
representation inference. This CL propagates and uses the recomputed types
for Phi and Select nodes (rather than using the types from the typer).

Review URL: https://codereview.chromium.org/1580353003

Cr-Commit-Position: refs/heads/master@{#33268}

This bug improves performance of escape analysis.

* A allocation discovery phase  (EscapeAnalysis::AssignAliases)
  ensures compact representation of virtual state
* Node revisiting in EscapeStatusAnalysis has been improved
* Escape analysis no longer requires a trimmed graph

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1559123003

Cr-Commit-Position: refs/heads/master@{#33267}

Port 5091e8f2

TEST=cctest/test-assembler-mips64/jump_tables1,cctest/test-assembler-mips64/jump_tables2,cctest/test-assembler-mips64/jump_tables3,cctest/test-macro-assembler-mips/jump_tables5
BUG=

Review URL: https://codereview.chromium.org/1582533005

Cr-Commit-Position: refs/heads/master@{#33266}

Also migrate the Number constructor to a native builtin, using the
same mechanism already used by the String constructor. Otherwise just
parsing and compiling the Number constructor to optimized code already
eats 2ms on desktop for no good reason, and the resulting optimized
code is not even close to awesome.

Drive-by-fix: Use correct context for the [[Construct]] case of the
String constructor as well, and share some code with it.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1573243009

Cr-Commit-Position: refs/heads/master@{#33265}

Code copied 1:1 from chromium.

BUG=chromium:565952
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1580193004

Cr-Commit-Position: refs/heads/master@{#33264}

This uses the bots introduced here:
https://codereview.chromium.org/1581803003/

BUG=chromium:535160
LOG=n
NOTRY=true
NOPRESUBMIT=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1588543002

Cr-Commit-Position: refs/heads/master@{#33263}

ReportFailedAccessCheck() sometimes doesn't throw an exception (it's up
to the embedder). Pretend that OrdinaryDefineOwnProperty() succeeded in
that case. This is consistent with existing behavior of other methods:
- JSObject::DefineOwnPropertyIgnoreAttributes
- JSObject::SetPropertyWithFailedAccessCheck
- Object::SetPropertyWithAccessor

See also commit f66c3f5c.

BUG=chromium:574217
LOG=n
R=neis@chromium.org

Review URL: https://codereview.chromium.org/1580823002

Cr-Commit-Position: refs/heads/master@{#33262}

R=jarin@chromium.org
BUG=v8:4650
LOG=Y

Review URL: https://codereview.chromium.org/1574113009

Cr-Commit-Position: refs/heads/master@{#33261}

(fast_handler *has* a more specific type; the TODO is no longer applicable.)

R=epertoso@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1577233003

Cr-Commit-Position: refs/heads/master@{#33260}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1587483003

Cr-Commit-Position: refs/heads/master@{#33259}

The API functions are always in sloppy mode, so receiver is always a
JSReceiver once the actual call trampoline runs, no need to check again
in various places.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1575973006

Cr-Commit-Position: refs/heads/master@{#33258}

Rolling v8/tools/clang to afad7aa23b146a86be9bc335caaac5bcfa72f390

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1584673002

Cr-Commit-Position: refs/heads/master@{#33257}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1583603002

Cr-Commit-Position: refs/heads/master@{#33256}

Review URL: https://codereview.chromium.org/1580123002

Cr-Commit-Position: refs/heads/master@{#33255}

http://tc39.github.io/ecma262/#sec-destructuring-assignment-static-semantics-early-errors
requires that DestructuringAssignmentTargets which do not match Pattern productions,
must return true for IsValidSimpleAssignmentTarget.

This change rejects parenthesized patterns with a SyntaxError.

BUG=v8:4662, v8:811
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, nikolaos@chromium.org

Review URL: https://codereview.chromium.org/1585473002

Cr-Commit-Position: refs/heads/master@{#33254}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1584573002

Cr-Commit-Position: refs/heads/master@{#33253}

Failing to do so results in out-of-date marking information, because live bytes
is not properly adjusted.

This CL adds support for right trimming ByteArray and properly DCHECKs that we
do not left trim  ByteArray (as we already do for FixedTypedArrayBase).

BUG=

Review URL: https://codereview.chromium.org/1577263003

Cr-Commit-Position: refs/heads/master@{#33252}