Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype
> transition on the base constructor's initial map. This approach fixes in-object slack tracking
> for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

It also fixes typed array map smashing done during typed array initialization.

BUG=v8:3101, v8:3330, v8:4419
LOG=Y

Review URL: https://codereview.chromium.org/1413033006

Cr-Commit-Position: refs/heads/master@{#31701}

Return undefined for missing properties (or throw an exception in strong
mode). Also do a bit of code cleanup.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1427913003

Cr-Commit-Position: refs/heads/master@{#31700}

Rolling v8/buildtools to c2f259809d5ede3275df5ea0842f0431990c4f98

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1406153016

Cr-Commit-Position: refs/heads/master@{#31699}

This utility makes it possible to test TF graphs that accept parameters of any machine type (even int64 and float64), which are previously problematic due to the complexity of C calling conventions.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1423133005

Cr-Commit-Position: refs/heads/master@{#31698}

Adds an optimization to emit JumpIfToBooleanTrue/False instead
of ToBoolean followed by JumpIfTrue/False if the value in the
accumulator is not boolean.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1426913002

Cr-Commit-Position: refs/heads/master@{#31697}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1421973007

Cr-Commit-Position: refs/heads/master@{#31696}

This introduces an AllocateMutableHeapNumberStub for the boxed double
field case, where we need to allocate a box in case of a transitioning
store first. We cannot use our inline allocations for this currently,
because mutable HeapNumber objects have certain alignment constraints,
and I don't want to mess up Allocate/AllocateInNewSpace eagerly.

Also refactor the PropertyAccessInfoFactory slightly to split the long
methods into simpler parts.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1419173007

Cr-Commit-Position: refs/heads/master@{#31695}

This re-introduces the long lost concept of conditional builder methods
into the AstGraphBuilder that are allowed to return {nullptr} when a
certain optimization does not apply. This can be used to separate our
optimizations in the graph builder clearly from code required for
correctness.

R=bmeurer@chromium.org
BUG=v8:4513
LOG=n

Review URL: https://codereview.chromium.org/1414723004

Cr-Commit-Position: refs/heads/master@{#31694}

This makes FullCodeGenerator::VisitCall be independent of the target
architecture. Only the EmitPossiblyEvalCall case was dependent and is
hoisted into an emitter method.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1428953002

Cr-Commit-Position: refs/heads/master@{#31693}

Also changed the way that transitioning stores are represented in
a PropertyAccessInfo: There's no dedicated kind, but DataFields
have an optional transition map.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1416973014

Cr-Commit-Position: refs/heads/master@{#31692}

BUG=chrome-os-partner:36669
R=jochen@chromium.org
LOG=N
Signed-off-by: Milton Chiang <milton.chiange@mediatek.com>

Review URL: https://codereview.chromium.org/1223613003

Cr-Commit-Position: refs/heads/master@{#31691}

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1427003006

Cr-Commit-Position: refs/heads/master@{#31690}

If the CallIC collected a known target function for a callsite, add
a runtime check to ensure that the feedback remains the same and
specialize the JSCallFunction node to the known target function so that
inlining and typed lowering can pick up the feedback.

R=mstarzinger@chromium.org
BUG=v8:4470, v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1428923002

Cr-Commit-Position: refs/heads/master@{#31689}

Removes deprecated functions from the following files:
 test/cctest/interpreter/test-bytecode-generator.cc
 test/cctest/interpreter/test-interpreter.cc

BUG=v8:4134
LOG=N

Review URL: https://codereview.chromium.org/1421223005

Cr-Commit-Position: refs/heads/master@{#31688}

Adds support for switch statments to the interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1415093006

Cr-Commit-Position: refs/heads/master@{#31687}

R=yangguo@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1427583008

Cr-Commit-Position: refs/heads/master@{#31686}

Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1415883007

Cr-Commit-Position: refs/heads/master@{#31685}

Revert of [es6] Better support for built-ins subclassing. (patchset #8 id:200001 of https://codereview.chromium.org/1427483002/ )

Reason for revert:
Breaks test on win32 nosnap.http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/9680

Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1416943005

Cr-Commit-Position: refs/heads/master@{#31684}

Adds wide bytecode varients, which take 16-bit feedback slot and constant
pool entry indexes for the following bytecodes:
  - LoadICSloppyWide
  - LoadICStrictWide
  - KeyedLoadICSloppyWide
  - KeyedLoadICStrictWide
  - StoreICSloppyWide
  - StoreICStrictWide
  - KeyedStoreICSloppyWide
  - KeyedStoreICStrictWide
  - LdaGlobalSloppyWide
  - LdaGlobalStrictWide
  - StaGlobalSloppyWide
  - StaGlobalStrictWide
  - LdaConstantWide

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1413863010

Cr-Commit-Position: refs/heads/master@{#31683}

This is currently hardcoded in the infra-side test runner
setup, but will be removed there, so that swarming triggers
don't need a custom environment.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1411733008

Cr-Commit-Position: refs/heads/master@{#31682}

This moves the cctest file for the interpreter to live in the same
namespace as the components it is testing. Hence we can avoid the
forbidden using directives pulling in entire namespaces.

From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1410993009

Cr-Commit-Position: refs/heads/master@{#31681}

Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
This CL also fixes subclassing from String.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1427483002

Cr-Commit-Position: refs/heads/master@{#31680}

Revert of Remove RegExp.multiline accessors. (patchset #3 id:40001 of https://codereview.chromium.org/1410993008/ )

Reason for revert:
[Sheriff] Causes layout test failures.

Original issue's description:
> Remove RegExp.multiline accessors.
>
> This is non-standard and not even documented on MDN.
>
> On Firefox, setting RegExp.multiline to true adds the multiline flag to all
> newly created RegExp objects (both from constructor and from literal).
>
> In V8 this has no effect.
>
> Source archaelogy shows that this is from the initial commit.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/e8f752ce0c2a488e88cd87fe75f3907b4303d0a0
> Cr-Commit-Position: refs/heads/master@{#31673}

TBR=bmeurer@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1431433004

Cr-Commit-Position: refs/heads/master@{#31679}

This is in preparation of implementing Reflect.set.

Besides making SetSuperProperty and others return Maybe<bool>, this CL
also fixes some parts of my previous refactoring of SetProperty and
others: It doesn't make sense to take both a language_mode and a
should_throw argument.  A strict language_mode should imply
THROW_ON_ERROR.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1431443003

Cr-Commit-Position: refs/heads/master@{#31678}

BUG=chromium:549162
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1424293002

Cr-Commit-Position: refs/heads/master@{#31677}

This adds optimized lowering for JSConvertReceiver (in the general case)
and JSToObject in typed lowering. It also uses JSConvertReceiver for
direct calls in typed lowering.

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1431543002

Cr-Commit-Position: refs/heads/master@{#31676}

Adds new Guard[Type] common operator, which takes value and control
inputs and records a guaranty that a certain value has a certain type
in that control path.  This is some kind of ad-hoc SSI similar to what
we have to do in Crankshaft in some places.

Also introduces an ObjectIsNumber simplified operator, which checks
whether a certain value is a number (either a Smi or a HeapNumber).

This doesn't yet support transitioning stores to double fields, which
require support for allocating mutable heap numbers.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1420283009

Cr-Commit-Position: refs/heads/master@{#31675}

Proxies are not properly supported yet.

R=rossberg, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1408163005

Cr-Commit-Position: refs/heads/master@{#31674}

This is non-standard and not even documented on MDN.

On Firefox, setting RegExp.multiline to true adds the multiline flag to all
newly created RegExp objects (both from constructor and from literal).

In V8 this has no effect.

Source archaelogy shows that this is from the initial commit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410993008

Cr-Commit-Position: refs/heads/master@{#31673}

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1425143002

Cr-Commit-Position: refs/heads/master@{#31672}

This moves all cctest files for the compiler to live in the same
namespace as the components they are testing. Hence we can avoid the
forbidden using directives pulling in entire namespaces.

From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1424943004

Cr-Commit-Position: refs/heads/master@{#31671}

If you are not logged in with your Google account you are
faced with a blank screen. In order to make it more
clear for the Chromium sheriffs on how to close the
auto-roller I want to add this information.

R=machenbach@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1392823004

Cr-Commit-Position: refs/heads/master@{#31670}

BUG=

Review URL: https://codereview.chromium.org/1418213007

Cr-Commit-Position: refs/heads/master@{#31669}

In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1425883004

Cr-Commit-Position: refs/heads/master@{#31668}

Rolling v8/buildtools to acafdaa4e81adae617177d57e3c1261cc3565469

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1420973008

Cr-Commit-Position: refs/heads/master@{#31667}

We have plans to create more ICs, and we are out of bits to represent the Kind
in the flags field of the code object. The InlineCacheState can lose a bit
because it no longer needs the DEFAULT state. That state existed as a way to
detect errors where code incorrectly looked at a vector IC stub's
InlineCacheState instead of correctly determining said state from a glance at
the vector. This really isn't a danger anymore.

So, with the horse trading, we could now represent up to 32 code kinds.

BUG=

Review URL: https://codereview.chromium.org/1427803003

Cr-Commit-Position: refs/heads/master@{#31666}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1423673003

Cr-Commit-Position: refs/heads/master@{#31665}

This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}

Most use sites of Call::GetCallType already distinguish the property
call case (i.e. formerly known as Call::PROPERTY_CALL) further. This
introduces this distinction to simplify use sites.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1414413004

Cr-Commit-Position: refs/heads/master@{#31663}

we may introduce moves that are redundant in the context of
moves on subsequent instructions. Currently, we only detect such
redundancies by allowing moves to skip over Nop instructions (true
nops, with no input/output). We can also skip over other cases, for
example over constant definitions (nop with an output), since whatever
moves happen above it do not influence the instruction's outcome.

We may be able to handle other cases, too - in subsequent CLs.

BUG=

Review URL: https://codereview.chromium.org/1422333003

Cr-Commit-Position: refs/heads/master@{#31662}