Port 7b9670b6

Only fails in debug builds.

TEST=mjsunit/harmony/simd
BUG=

Review URL: https://codereview.chromium.org/1264103005

Cr-Commit-Position: refs/heads/master@{#29993}

Adds Int32x4, Bool32x4, Int16x8, Bool16x8, Int8x16, Bool8x16.
Adds Simd128Value base heap object class.
Changes heap/factory construction pattern to use arrays.
Adds replaceLane functions to facilitate testing.

NOPRESUBMIT=true
(presubmit checks erroneously interpret array declaration in macro definition as variable size array.)

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1250733005

Cr-Commit-Position: refs/heads/master@{#29974}

Introduce new mechanism for relocating j/jal.

Resolves flaky failures of mozilla regress tests.

Additionally:

- internal encoded references are not relocated during code generation phase.
- remove asserts from j and jal which are not
valid because addresses are not final and valid in code generation phase.

TEST=mozilla/js1_5/Regress/regress-280769-2, regress-367561-01,
     mozilla/ecma_3/Statements/regress-444979
BUG=
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/1216823003 .

Patch from dusan.milosavljevic <dusan.milosavljevic@imgtec.com>.

Cr-Commit-Position: refs/heads/master@{#29962}

Since we need the notion of a dummy vector ic, we can use that to avoid
a special case of the IC constructor. Also, consolidate the two dummy
ICs into one.

BUG=

Review URL: https://codereview.chromium.org/1268783004

Cr-Commit-Position: refs/heads/master@{#29956}

This is the initial (big) step towards a more uniform implementation of
the ToObject abstract operation (ES6 7.1.13), where we have a fallback
implementation in JSReceiver::ToObject() and a fast (hydrogen) CodeStub
to deal with the fast case (we should be able to do more cleanup on this
in a followup CL).  For natives we expose the abstract operation via a
%_ToObject intrinsic, also exposed via a macro TO_OBJECT, that unifies
the previous confusion with TO_OBJECT_INLINE, ToObject, TO_OBJECT,
$toObject and %$toObject.  Now the whole implementation of the abstract
operation is context independent, meaning we don't need any magic in the
builtins object nor the native context.

R=mvstanton@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1266013006

Cr-Commit-Position: refs/heads/master@{#29953}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1265923002

Cr-Commit-Position: refs/heads/master@{#29951}

Adds interpreter entry and exit trampoline builtins. Also implements the
Return bytecode handler and fixes a few bugs in InterpreterAssembler
highlighted by running on other architectures.

MIPS and MIPS64 port contributed by Paul Lind (paul.lind@imgtec.com)

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1245133002

Cr-Commit-Position: refs/heads/master@{#29929}

All runtime function get a context anyway, which is the same as the
explicit one in case of DeclareGlobals and DeclareLookupSlot. So
we can remove the additional parameter there.

As an additional bonus, improve the runtime interface to DeclareLookupSlot.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1261863002

Cr-Commit-Position: refs/heads/master@{#29923}

Adapted disassembler for J and JAL instructions.

TEST=cctest/test-disasm-mips/Type0,
     cctest/test-disasm-mips64/Type3
BUG=

Review URL: https://codereview.chromium.org/1258743004

Cr-Commit-Position: refs/heads/master@{#29921}

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

BUG=v8:3996
R=bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1262583002

Cr-Commit-Position: refs/heads/master@{#29893}

No need to pass the name explicitly to the stubs; the runtime can
extract the name from the ScopeInfo (the extension of the
ScriptContext) on-demand easily without any performance impact.

Review URL: https://codereview.chromium.org/1259963002

Cr-Commit-Position: refs/heads/master@{#29886}

Revert of Remove ExternalArray, derived types, and element kinds (patchset #5 id:80001 of https://codereview.chromium.org/1254623002/)

Reason for revert:
[Sheriff] Breaks several layout tests, e.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/1067

Several output lines change from PASS to FAIL. If the changes are intended, please land a needsmanualrebaseline change in blink first.

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

TBR=bmeurer@chromium.org,hpayer@chromium.org,jarin@chromium.org,mvstanton@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1257223002

Cr-Commit-Position: refs/heads/master@{#29883}

We don't need the hole check and slow runtime mode for read-only
properties this way.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1255133002

Cr-Commit-Position: refs/heads/master@{#29881}

BUG=v8:3996
R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1254623002

Cr-Commit-Position: refs/heads/master@{#29872}

BUG=

Review URL: https://codereview.chromium.org/1255883002

Cr-Commit-Position: refs/heads/master@{#29870}

Review URL: https://codereview.chromium.org/1259853002

Cr-Commit-Position: refs/heads/master@{#29860}

Also make a minor improvement in the mips32 StoreGlobalViaContextStub
and fix some bad comments in the macro-assembler.

BUG=

Review URL: https://codereview.chromium.org/1254153002

Cr-Commit-Position: refs/heads/master@{#29859}

Fix invalid tail calls and wrong context register.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1257603004

Cr-Commit-Position: refs/heads/master@{#29844}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1248443003

Cr-Commit-Position: refs/heads/master@{#29840}

This is the initial round of optimizations for the
LoadGlobalViaContextStub and StoreGlobalViaContextStub, basically
turning them into platform code stubs to avoid the Crankshaft overhead
in the fast case, and making the runtime interface cheaper.

R=ishell@chromium.org
BUG=chromium:510694
LOG=n

Review URL: https://codereview.chromium.org/1238143002

Cr-Commit-Position: refs/heads/master@{#29834}

Review URL: https://codereview.chromium.org/1251593009

Cr-Commit-Position: refs/heads/master@{#29825}

All of this is controlled by the CallDescriptor. It's simply the case
that if you specify less registers than the function arity calls for,
the rest are assumed to be on the stack.

Bailout handlers accept these constant stack arguments too.

BUG=

Review URL: https://codereview.chromium.org/1250563004

Cr-Commit-Position: refs/heads/master@{#29813}

Previous to this CL, ICs used a slightly different code idiom
to get to C++ code from generated code than runtime intrinsics,
using an IC_Utility class that in essence provided exactly
the same functionality as Runtime::FunctionForId, but in its
own quirky way.

This CL unifies the two mechanisms, folding IC_Utility
away by making all IC entry points in C++ code, e.g. IC
miss handlers, full-fledged runtime intrinsics. This makes
it possible to eliminate a bunch of ad-hoc declarations and
adapters that the IC system had to needlessly re-invent.

As a bonus and the original reason for this yak-shave:
IC-related C++ runtime functions are now callable from
TurboFan.

Review URL: https://codereview.chromium.org/1248303002

Cr-Commit-Position: refs/heads/master@{#29811}

R=mvstanton@chromium.org

Committed: https://crrev.com/937d4efbf9c399339fdc8e041bec8e80baa7b58f
Cr-Commit-Position: refs/heads/master@{#29798}

Review URL: https://codereview.chromium.org/1255613002

Cr-Commit-Position: refs/heads/master@{#29805}

Revert of Reduce duplicate code in full-codegen across platforms. (patchset #1 id:1 of https://codereview.chromium.org/1255613002/)

Reason for revert:
breaks mips

Original issue's description:
> Reduce duplicate code in full-codegen across platforms.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/937d4efbf9c399339fdc8e041bec8e80baa7b58f
> Cr-Commit-Position: refs/heads/master@{#29798}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1252513004

Cr-Commit-Position: refs/heads/master@{#29802}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1255613002

Cr-Commit-Position: refs/heads/master@{#29798}

In simulator data trace, DSLL did not print result and
BAL/BGEZAL omitted result from an instruction executed
in delay slot.

TEST=cctest/test-assembler-mips[64]
BUG=

Review URL: https://codereview.chromium.org/1245173002

Cr-Commit-Position: refs/heads/master@{#29796}

It's just the same as StoreTransitionDescriptor.

BUG=

Review URL: https://codereview.chromium.org/1248973002

Cr-Commit-Position: refs/heads/master@{#29789}

This fixes a recent regression where the register holding the original
receiver was pushed onto the stack before the internal frame within the
CallStubInRecordCallTarget helper was created. That in turn confused
the stack walker when allocations in these stubs failed.

R=mvstanton@chromium.org
BUG=chromium:512711
LOG=N

Review URL: https://codereview.chromium.org/1245043003

Cr-Commit-Position: refs/heads/master@{#29787}

The layout of fixed typed array base is then capable of handling
external typed arrays as well. In a follow-up CL, I'll delete external
typed arrays, and use fixed typed array base instead

BUG=v8:3996
R=jarin@chromium.org,mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1248483007

Cr-Commit-Position: refs/heads/master@{#29786}

This will be used to compute the base pointer of the new unified
representation for both on-heap and external typed arrays. The idea is
that either the external or the tagged pointer is 0 (although in
practice, if the tagged pointer is non-0, the external pointer will
contain the offset from the start of the on-heap typed array to the data
in the on-heap typed array).

The HAdd is marked as depending on new-space promotion, as the tagged
pointer might move during GC, and so the result of the addition needs to
be recomputed.

BUG=v8:3996
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1244693002

Cr-Commit-Position: refs/heads/master@{#29760}

Prior to this patch, we enter a global debug mode whenever a break point
is set. By entering this mode, all code is deoptimized and activated
frames are recompiled and redirected to newly compiled debug code.

After this patch, we only deoptimize/redirect for functions we want to
debug. Trigger for this is Debug::EnsureDebugInfo, and having DebugInfo
object attached to the SFI prevents optimization/inlining.

The result is that we can have optimized code for functions without break
points alongside functions that do have break points, which are not
optimized.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=v8:4132
LOG=Y

Review URL: https://codereview.chromium.org/1233073005

Cr-Commit-Position: refs/heads/master@{#29758}

This adds the implicit function variable for a function literal to the
declarations list in scope analysis, instead of specially handling it
throughout all back-ends.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1245603003

Cr-Commit-Position: refs/heads/master@{#29754}

BUG=chromium:510738
LOG=N

Review URL: https://codereview.chromium.org/1228113008

Cr-Commit-Position: refs/heads/master@{#29743}

Additionally, push the allocation site or undefined independently of creating a memento to preserve a fixed size for the construct frames.

BUG=

Review URL: https://codereview.chromium.org/1239593003

Cr-Commit-Position: refs/heads/master@{#29719}

This CL exposes the constructor function, defines type related
information, and implements value type semantics.
It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.

TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc

LOG=Y
BUG=v8:4124

Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
Cr-Commit-Position: refs/heads/master@{#29689}

Review URL: https://codereview.chromium.org/1219943002

Cr-Commit-Position: refs/heads/master@{#29712}

The aforementioned intrinsic is no longer needed and can be fully
desugared now that binding assignments to 'this' are explicit.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1234383002

Cr-Commit-Position: refs/heads/master@{#29706}

This makes the implicit initializing assignment to 'this' performed
after a super constructor call explicit in the AST. It removes the
need to handle the special case where a CallExpression behaves like a
AssignmentExpression from various AstVisitor implementations.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1226123010

Cr-Commit-Position: refs/heads/master@{#29705}

Revert of Expose SIMD.Float32x4 type to Javascript. (patchset #14 id:450001 of https://codereview.chromium.org/1219943002/)

Reason for revert:
Seems to brake the latest roll into Chromium: http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_compile_dbg_ng/builds/59796/steps/compile%20%28with%20patch%29/logs/stdio

Original issue's description:
> Expose SIMD.Float32x4 type to Javascript.
> This CL exposes the constructor function, defines type related
> information, and implements value type semantics.
> It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.
>
> TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc
>
> LOG=Y
> BUG=v8:4124
>
> Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
> Cr-Commit-Position: refs/heads/master@{#29689}

TBR=rossberg@chromium.org,littledan@chromium.org,martyn.capewell@arm.com,bbudge@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review URL: https://codereview.chromium.org/1241533004

Cr-Commit-Position: refs/heads/master@{#29701}

Improved checking target ranges for J and JAL instructions.
Adapted disassembler test for J and JAL instructions.

TEST=cctest/test-disasm-mips[64]
BUG=

Review URL: https://codereview.chromium.org/1237083003

Cr-Commit-Position: refs/heads/master@{#29693}