TBR=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1777483011 .

Cr-Commit-Position: refs/heads/master@{#34667}

BUG=593359
LOG=y

Review URL: https://codereview.chromium.org/1779713005

Cr-Commit-Position: refs/heads/master@{#34666}

BUG=chromium:568495
LOG=NO

Review URL: https://codereview.chromium.org/1775003003

Cr-Commit-Position: refs/heads/master@{#34665}

NOPRESUBMIT=true
BUG=

Review URL: https://codereview.chromium.org/1776353002

Cr-Commit-Position: refs/heads/master@{#34664}

BUG=chromium:535160,chromium:568949
LOG=n
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1778313002

Cr-Commit-Position: refs/heads/master@{#34663}

Only CPSR_f is supported, and then only for the flags that we actually
simulate (NZCV). This isn't currently used, but will be useful for some
tests.

BUG=

Review URL: https://codereview.chromium.org/1776933003

Cr-Commit-Position: refs/heads/master@{#34662}

Previously, optimization has been disabled because of an assertion
failure, which requires the context to be linked into the weak native
context list of the heap.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1777883003

Cr-Commit-Position: refs/heads/master@{#34661}

Inline calling into the interceptor into the IC callbacks rather than going through the LookupIterator.

This is highly performance sensitive as there is no faster path; it's
used directly by the IC.

BUG=chromium:592305
LOG=n

Review URL: https://codereview.chromium.org/1778493005

Cr-Commit-Position: refs/heads/master@{#34660}

BUG=v8:4680
LOG=n
NOTRY=true
TBR=rmcilroy@chromium.org
NOTREECHECKS=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1778323002

Cr-Commit-Position: refs/heads/master@{#34659}

Cr-Commit-Position: refs/heads/master@{#34658}

Changes include:
 - better test coverage for builds with snapshot
 - write snapshot blobs to buffer instead of test serialization files
 - renamed tests

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1777213002

Cr-Commit-Position: refs/heads/master@{#34657}

  port 240b7db9 (r34630)

  original commit message:
  I implemented I64ShrU and I64ShrS the same as I64Shl in https://codereview.chromium.org/1756863002

BUG=

Review URL: https://codereview.chromium.org/1783703003

Cr-Commit-Position: refs/heads/master@{#34656}

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1778663005

Cr-Commit-Position: refs/heads/master@{#34655}

We must close the iterator whenever the destructuring didn't exhaust it, unless an iterator operation (eg. next) threw.  We do this by wrapping the iterator use in a try-catch-finally similar to the desugaring of for-of.

This is behind --harmony-iterator-close.

R=adamk@chromium.org
BUG=v8:3566
LOG=Y

Review URL: https://codereview.chromium.org/1772793002

Cr-Commit-Position: refs/heads/master@{#34654}

Cr-Commit-Position: refs/heads/master@{#34653}

  port 5096492f (r34627)

  original commit message:
  - Eliminate stubs with a variable number of arguments.
    (That only worked due to their very limited use. These
     stubs' interface descriptors were basically lying
     about their number of args, which will fail when used
     generically.)
  - Fix all CallApi*Stubs' interface descriptors to no
    longer lie about their arguments.
  - Unify CallApi*Stub, for * in Function, Accessor,
    FunctionWithFixedArgs.
    (Since these are now all doing the same thing.)
  - Rename the unified stub (and interface descriptors) to
    *ApiCallback*, since that's really what they're doing.
  - Refuse inlining an API callback if its number of
    parameters exceeds the supported number of args.

BUG=

Review URL: https://codereview.chromium.org/1783713002

Cr-Commit-Position: refs/heads/master@{#34652}

  port c29a4560(r34610)

  original commit message:
  In case when F was called with incompatible number of arguments (and therefore
  the arguments adator frame was created), F inlines a tail call of G which then
  deopts the deoptimizer should also remove the arguments adaptor frame for F.

  This CL adds required machinery to the deoptimizer.

BUG=

Review URL: https://codereview.chromium.org/1785593002

Cr-Commit-Position: refs/heads/master@{#34651}

  port 679d9503(r34608)

  original commit message:
  According to https://www.w3.org/TR/html5/obsolete.html#dom-document-all,
  comparisons of document.all to other values such as strings or objects,
  are unaffected. In fact document.all only gets special treatment in
  comparisons with null or undefined according to HTML. Especially setting
  the undetectable doesn't make two distinct JSReceivers equal.

BUG=

Review URL: https://codereview.chromium.org/1784763002

Cr-Commit-Position: refs/heads/master@{#34650}

Rolling v8/tools/clang to fc7b250f6ca03bcbcd2cd1a3e4102cb639a2814a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1784643005

Cr-Commit-Position: refs/heads/master@{#34649}

  port 9dcd0857 (r34571)

  original commit message:
  Before this CL, various code stubs used different techniques
  for marking their frames to enable stack-crawling and other
  access to data in the frame. All of them were based on a abuse
  of the "standard" frame representation, e.g. storing the a
  context pointer immediately below the frame's fp, and a
  function pointer after that. Although functional, this approach
  tends to make stubs and builtins do an awkward, unnecessary
  dance to appear like standard frames, even if they have
  nothing to do with JavaScript execution.

  This CL attempts to improve this by:

  * Ensuring that there are only two fundamentally different
    types of frames, a "standard" frame and a "typed" frame.
    Standard frames, as before, contain both a context and
    function pointer. Typed frames contain only a minimum
    of a smi marker in the position immediately below the fp
    where the context is in standard frames.
  * Only interpreted, full codegen, and optimized Crankshaft and
    TurboFan JavaScript frames use the "standard" format. All
    other frames use the type frame format with an explicit
    marker.
  * Typed frames can contain one or more values below the
    type marker. There is new magic macro machinery in
    frames.h that simplifies defining the offsets of these fields
    in typed frames.
  * A new flag in the CallDescriptor enables specifying whether
    a frame is a standard frame or a typed frame. Secondary
    register location spilling is now only enabled for standard
    frames.
  * A zillion places in the code have been updated to deal with
    the fact that most code stubs and internal frames use the
    typed frame format. This includes changes in the
    deoptimizer, debugger, and liveedit.
  * StandardFrameConstants::kMarkerOffset is deprecated,
    (CommonFrameConstants::kContextOrFrameTypeOffset
    and StandardFrameConstants::kFrameOffset are now used
    in its stead).

BUG=

Review URL: https://codereview.chromium.org/1774353002

Cr-Commit-Position: refs/heads/master@{#34648}

BUG=v8:4348
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1783643002

Cr-Commit-Position: refs/heads/master@{#34647}

This flag bans illegal (and likely useless) constructs like

for (;;) function f() {}

R=adamk
BUG=v8:4824
LOG=Y

Review URL: https://codereview.chromium.org/1781653005

Cr-Commit-Position: refs/heads/master@{#34646}

Port 679d9503

Original commit message:
    According to https://www.w3.org/TR/html5/obsolete.html#dom-document-all,
    comparisons of document.all to other values such as strings or objects,
    are unaffected. In fact document.all only gets special treatment in
    comparisons with null or undefined according to HTML. Especially setting
    the undetectable doesn't make two distinct JSReceivers equal.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1785503002

Cr-Commit-Position: refs/heads/master@{#34645}

Port c29a4560

Original commit message:
    In case when F was called with incompatible number of arguments (and therefore
    the arguments adator frame was created), F inlines a tail call of G which then
    deopts the deoptimizer should also remove the arguments adaptor frame for F.

    This CL adds required machinery to the deoptimizer.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1775393004

Cr-Commit-Position: refs/heads/master@{#34644}

Port 9dcd0857

Original commit message:
    Before this CL, various code stubs used different techniques
    for marking their frames to enable stack-crawling and other
    access to data in the frame. All of them were based on a abuse
    of the "standard" frame representation, e.g. storing the a
    context pointer immediately below the frame's fp, and a
    function pointer after that. Although functional, this approach
    tends to make stubs and builtins do an awkward, unnecessary
    dance to appear like standard frames, even if they have
    nothing to do with JavaScript execution.

    This CL attempts to improve this by:

    * Ensuring that there are only two fundamentally different
      types of frames, a "standard" frame and a "typed" frame.
      Standard frames, as before, contain both a context and
      function pointer. Typed frames contain only a minimum
      of a smi marker in the position immediately below the fp
      where the context is in standard frames.
    * Only interpreted, full codegen, and optimized Crankshaft and
      TurboFan JavaScript frames use the "standard" format. All
      other frames use the type frame format with an explicit
      marker.
    * Typed frames can contain one or more values below the
      type marker. There is new magic macro machinery in
      frames.h that simplifies defining the offsets of these fields
      in typed frames.
    * A new flag in the CallDescriptor enables specifying whether
      a frame is a standard frame or a typed frame. Secondary
      register location spilling is now only enabled for standard
      frames.
    * A zillion places in the code have been updated to deal with
      the fact that most code stubs and internal frames use the
      typed frame format. This includes changes in the
      deoptimizer, debugger, and liveedit.
    * StandardFrameConstants::kMarkerOffset is deprecated,
      (CommonFrameConstants::kContextOrFrameTypeOffset
      and StandardFrameConstants::kFrameOffset are now used
      in its stead).

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1778713002

Cr-Commit-Position: refs/heads/master@{#34643}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1779803004

Cr-Commit-Position: refs/heads/master@{#34642}

R=binji@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1783593002

Cr-Commit-Position: refs/heads/master@{#34641}

BUG=v8:4247
LOG=y

Review URL: https://codereview.chromium.org/1781573003

Cr-Commit-Position: refs/heads/master@{#34640}

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1776923005

Cr-Commit-Position: refs/heads/master@{#34639}

As described in unicode database file PropertyValueAliases.txt

R=littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1776953002

Cr-Commit-Position: refs/heads/master@{#34638}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1781523002

Cr-Commit-Position: refs/heads/master@{#34637}

When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340

Review URL: https://codereview.chromium.org/1782443002

Cr-Commit-Position: refs/heads/master@{#34636}

R=binji@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1775123003

Cr-Commit-Position: refs/heads/master@{#34635}

BUG=chromium:468240
LOG=no

Review URL: https://codereview.chromium.org/1773273002

Cr-Commit-Position: refs/heads/master@{#34634}

Reading the registers' values back from the FrameDescription
should use the same offset computation as storing them into it.
The offsets must also match what the deoptimizer expects, which
is rx at offset rx.code() * kDoubleSize, even if some registers
are not saved (leaving gaps).

BUG=v8:4800
LOG=n
R=danno@chromium.org

Review URL: https://codereview.chromium.org/1769833006

Cr-Commit-Position: refs/heads/master@{#34633}

Port 9d0cf920

Bug Descriptions:
1. We are missing drotr32 instruction
2. Ror Macro should also handle values less than zero or bigger than 31, as WASM instruction kExprI32Rol will generate shifting operands beyond [0 .. 31] range.
3. Same as Dror.
4. drotrv instruction in simulator is incorrect.

BUG=
TEST=cctest/test-run-wasm/Run_WasmInt32Binops,cctest/test-run-wasm/Run_WasmInt64Binops

Review URL: https://codereview.chromium.org/1776623002

Cr-Commit-Position: refs/heads/master@{#34632}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1772403002

Cr-Commit-Position: refs/heads/master@{#34631}

I implemented I64ShrU and I64ShrS the same as I64Shl in https://codereview.chromium.org/1756863002

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1768233002

Cr-Commit-Position: refs/heads/master@{#34630}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1776613002

Cr-Commit-Position: refs/heads/master@{#34629}

BUG=

Review URL: https://codereview.chromium.org/1776803003

Cr-Commit-Position: refs/heads/master@{#34628}