Drive-by-fix: Move IC::GetRootConstructor to Map::GetConstructorFunction,
so we can use that in the ICs, Crankshaft and Turbofan.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1416493007

Cr-Commit-Position: refs/heads/master@{#31577}

R=bmeurer@chromium.org

Committed: https://crrev.com/15f36b2b1e166a511966a9991fddea94f890a755
Cr-Commit-Position: refs/heads/master@{#31566}

Review URL: https://codereview.chromium.org/1423833003

Cr-Commit-Position: refs/heads/master@{#31576}

Adds support and tests for conditional (ternary) expressions.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1417053004

Cr-Commit-Position: refs/heads/master@{#31575}

Revert of [heap] remove unneeded call to LowerInlineAllocationLimit (patchset #2 id:20001 of https://codereview.chromium.org/1390013002/ )

Reason for revert:
Causes memory footprint regression: https://code.google.com/p/chromium/issues/detail?id=541135

The intent of the code here was to advance the inline allocation limit without counting the allocated memory towards a step. Calling LowerInlineAllocationLimit this way is a blunt way of doing it, but it works.

At this point it is simplest to revert this CL. My follow-on CL (https://codereview.chromium.org/1404523002/) can address the 'bluntness' of calling LowerInlineAllocationLimit from here along with leaving a comment about the intent.

revert_cq: 1
revert_reason_textarea: Causes memory footprint regression: https://code.google.com/p/chromium/issues/detail?id=541135

The intent of the code here was to advance the inline allocation limit without counting the allocated memory towards a step. Calling LowerInlineAllocationLimit this way is a blunt way of doing it, but it works.

At this point it is simplest to revert this CL. My follow-on CL (https://codereview.chromium.org/1404523002/) can address the 'bluntness' of calling LowerInlineAllocationLimit from here along with leaving a comment about the intent.

Original issue's description:
> [heap] remove unneeded call to LowerInlineAllocationLimit
>
> Calling LowerInlineAllocationLimit from the bottom of Heap::Scavenge seems to be
> a no-op.
>
>   new_space_.LowerInlineAllocationLimit(
>       new_space_.inline_allocation_limit_step());
>
> LowerInlineAllocatoinLimit does the following things:
>
> 1. Set the inline_allocation_limit_step_ to the passed in value. No-op.
> 2. Calls UpdateInlineAllocationLimit(0). This is unnecessary here as it has
>    already been called when new_space_.ResetAllocationInfo was called above.
> 3. Sets top_on_previous_step_. This again is unnecessary as it gets reached by
>    ResetAllocationInfo as well.
>
> BUG=
> R=hpayer@chromium.org,ulan@chromium.org
>
> Committed: https://crrev.com/9f8e8b835a468b1622c5350a01a97bc32c5b2fb7
> Cr-Commit-Position: refs/heads/master@{#31156}

TBR=hpayer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:541135
LOG=n

Review URL: https://codereview.chromium.org/1405043005

Cr-Commit-Position: refs/heads/master@{#31574}

BUG=

Review URL: https://codereview.chromium.org/1422973002

Cr-Commit-Position: refs/heads/master@{#31573}

R=bmeurer@chromium.org
TEST=mjsunit/tools/profviz
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419333003

Cr-Commit-Position: refs/heads/master@{#31572}

Revert of Assume that ReportFailedAccessCheck always schedules an exception. (patchset #1 id:1 of https://codereview.chromium.org/1420413002/ )

Reason for revert:
[Sheriff] Crashes in layout tests:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2539

#
# Fatal error in , line 0
# unreachable code
#

Original issue's description:
> Assume that ReportFailedAccessCheck always schedules an exception.
>
> R=verwaest@chromium.org
> BUG=
>
> Committed: https://crrev.com/effe76ad25c23bfd8be447930bd5d5126b1c9096
> Cr-Commit-Position: refs/heads/master@{#31560}

TBR=verwaest@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1424703002

Cr-Commit-Position: refs/heads/master@{#31571}

Revert of Canonicalize handles for optimized compilation. (patchset #1 id:1 of https://codereview.chromium.org/1423833003/ )

Reason for revert:
GC stress failure on ia32 optdebug:

/tmp/runfswAKT/out/Debug/d8 --test --random-seed=-1536184370 --turbo --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --enable-slow-asserts --debug-code --verify-heap --stack-size=46 /tmp/runfswAKT/test/mjsunit/mjsunit.js /tmp/runfswAKT/test/mjsunit/regress/regress-1132.js --gc-interval=500 --stress-compaction --concurrent-recompilation-queue-length=64 --concurrent-recompilation-delay=500 --concurrent-recompilation

Run #1
Exit code: -6
Result: FAIL
Expected outcomes: PASS
Duration: 00:06:279

Stderr:

#
# Fatal error in ../../src/hashmap.h, line 248
# Check failed: base::bits::IsPowerOfTwo32(capacity_).
#

==== C stack trace ===============================

Original issue's description:
> Canonicalize handles for optimized compilation.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/15f36b2b1e166a511966a9991fddea94f890a755
> Cr-Commit-Position: refs/heads/master@{#31566}

TBR=jochen@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1417013007

Cr-Commit-Position: refs/heads/master@{#31570}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1425643002

Cr-Commit-Position: refs/heads/master@{#31569}

Turn the DCHECK in the Typer into a CHECK, and don't silently continue
in production. This way we know that we will always make progress
towards the fixpoint.

R=jarin@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1422893003

Cr-Commit-Position: refs/heads/master@{#31568}

Introduce new typing rules for LoadField[Map], which try to take into
account stable map information if the object either has type Constant or
type Class. If the map of the object is stable but can transition we
have to introduce a code dependency in the Typer to make sure that the
information (the Constant type we infer for LoadField[Map]) is valid
(and stays valid).

This also settles the policy for depending on map stability: The
definition can introduce any number of maps, without having to pay
attention to stability (i.e. you can always use Type::Class to introduce
a map that is propagated along the value edges), and the use site is
responsible for checking that the type information is valid before using
it. I.e. if you use stable map information, you'll have to add a
stability dependency (or make sure the map cannot transition).

Drive-by-improvement: Add ReferenceEqualTyper which takes input types
into account for improved constant folding.

Drive-by-fix: Apply policy mentioned above to JSNativeContextSpecialization.

R=jarin@chromium.org, rossberg@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410953006

Cr-Commit-Position: refs/heads/master@{#31567}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1423833003

Cr-Commit-Position: refs/heads/master@{#31566}

From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410073004

Cr-Commit-Position: refs/heads/master@{#31565}

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1415253006

Cr-Commit-Position: refs/heads/master@{#31564}

Because that's what it actually does

R=verwaest@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1410073005

Cr-Commit-Position: refs/heads/master@{#31563}

BUG=

Review URL: https://codereview.chromium.org/1420933004

Cr-Commit-Position: refs/heads/master@{#31562}

Review URL: https://codereview.chromium.org/1414223004

Cr-Commit-Position: refs/heads/master@{#31561}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1420413002

Cr-Commit-Position: refs/heads/master@{#31560}

Revert of Ignore test failure for mjsunit/for-in-opt in gc stress. (patchset #1 id:1 of https://codereview.chromium.org/1295513004/ )

Reason for revert:
This test should work.

Original issue's description:
> Ignore test failure for mjsunit/for-in-opt in gc stress.
>
> TBR=hablich@chromium.org
> BUG=v8:4381
>
> Committed: https://crrev.com/22cf0b591968b7b305094d386d6b10e6c0e723cc
> Cr-Commit-Position: refs/heads/master@{#30245}

TBR=hablich@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4381
LOG=n

Review URL: https://codereview.chromium.org/1419823009

Cr-Commit-Position: refs/heads/master@{#31559}

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410393006

Cr-Commit-Position: refs/heads/master@{#31558}

LOG=N
BUG=chromium:545503

Review URL: https://codereview.chromium.org/1409073005

Cr-Commit-Position: refs/heads/master@{#31557}

BUG=v8:4460
LOG=n

Review URL: https://codereview.chromium.org/1419823008

Cr-Commit-Position: refs/heads/master@{#31556}

The data field is passed to the failed access check callback which blink
depends on.

BUG=none
R=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1427443002

Cr-Commit-Position: refs/heads/master@{#31555}

the memory reducer is enabled.

BUG=

Review URL: https://codereview.chromium.org/1419393002

Cr-Commit-Position: refs/heads/master@{#31554}

Currently we (mostly) infer FunctionType for JSFunction constants, and
match the FunctionType in the typing rule for JSCallFunction. This has
several drawbacks for JavaScript, especially we don't have Constant
types for global functions (i.e. String, Object, Reflect and friends).
Plus the FunctionType magic doesn't actually buy us anything. So this
changes the typing rule for HeapConstant constant to actually infer
Constant types for JSFunction objects and moves the recognition of
builtin functions to the typing rule for JSCallFunction.

Also adapts the specialized lowering in JSTypedLowering to Constant
functions instead of FunctionType, which has the additional advantage
that we can do the receiver wrapping/converting based on the (known)
SharedFunctionInfo.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420093005

Cr-Commit-Position: refs/heads/master@{#31553}

      The reason is when native_context_specialization flag is ture, X87 turbofan
      will hit the known issue that X87 will change a sNaN to qNaN by default. And
      then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

   reland https://codereview.chromium.org/1414733004/.

BUG=

Review URL: https://codereview.chromium.org/1419573007

Cr-Commit-Position: refs/heads/master@{#31552}

Cr-Commit-Position: refs/heads/master@{#31551}

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1412113004

Cr-Commit-Position: refs/heads/master@{#31550}

LOG=N
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1420833004

Cr-Commit-Position: refs/heads/master@{#31549}

BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1419583007

Cr-Commit-Position: refs/heads/master@{#31548}

Review URL: https://codereview.chromium.org/1411093006

Cr-Commit-Position: refs/heads/master@{#31547}

This patch simply fixes few typos which should have been features
and closure.

BUG=
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1413023003

Cr-Commit-Position: refs/heads/master@{#31546}

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1402383005

Cr-Commit-Position: refs/heads/master@{#31545}

This addresses an issue where the at-start splitting used
in the splintering mechanism was in conflict with the mechanics
used in linear allocator, in particular in the initial split/spill of
ranges for memory operands. We are already doing a split-at-start in
Greedy, so this change centralizes that to the base RegisterAllocator.

Verified locally that v8:4508 is addressed by this. Also, this fixes
the failures that required the revert
5308a999. See trybots at
issue 1425533002.

R=bmeurer@chromium.org,jarin@chromium.org
BUG= v8:4508
LOG=n

Review URL: https://codereview.chromium.org/1426583002

Cr-Commit-Position: refs/heads/master@{#31544}

Revert of X87: disable the regress-undefined-nan test case for x87. (patchset #1 id:1 of https://codereview.chromium.org/1414733004/ )

Reason for revert:
because of merge mistake, "regress/" is missed when skipping one test case for X87.

 "regress/" will be added when relanding it.

Original issue's description:
> X87: disable the regress-undefined-nan test case for x87.
>
>   The reason is when native_context_specialization flag is ture, X87 turbofan
>   will hit the known issue that X87 will change a sNaN to qNaN by default. And
>   then it will fail when bit-comparing the source (sNaN) and the result (qNaN).
>
> BUG=
>
> Committed: https://crrev.com/b3c719ebbad6c87afefa33a7d0b3f412b2e304db
> Cr-Commit-Position: refs/heads/master@{#31530}

TBR=bmeurer@chromium.org,weiliang.lin@intel.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1417303005

Cr-Commit-Position: refs/heads/master@{#31543}

    port e678a0f9 (r31358)

    original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

BUG=

Review URL: https://codereview.chromium.org/1421803002

Cr-Commit-Position: refs/heads/master@{#31542}

    port 053e280c (r31319).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1420233002

Cr-Commit-Position: refs/heads/master@{#31541}

Cr-Commit-Position: refs/heads/master@{#31540}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413903003

Cr-Commit-Position: refs/heads/master@{#31539}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413013003

Cr-Commit-Position: refs/heads/master@{#31538}