When lowering Array.prototype.push/.pop to the fast inlined version, we
first need to ensure that all prototypes (including the Object.prototype)
are stable.

R=mvstanton@chromium.org
BUG=chromium:644689

Review-Url: https://codereview.chromium.org/2319533005
Cr-Commit-Position: refs/heads/master@{#39266}

BUG=

Review-Url: https://codereview.chromium.org/2304133002
Cr-Commit-Position: refs/heads/master@{#39265}

Reason for revert:
Breaks g++ build.

Original issue's description:
> [turbofan] ARM: Implement vswp and use in gap resolver
>
> Use vswp to switch double-precision registers in the gap resolver, with fall
> back temp register-based code if NEON is not available.
>
> BUG=
>
> Committed: https://crrev.com/2837c2e65a2ee5b9fc610f30ce1215f52323ecbd
> Cr-Commit-Position: refs/heads/master@{#39209}

BUG=

Review-Url: https://codereview.chromium.org/2314043002
Cr-Commit-Position: refs/heads/master@{#39264}

BUG=

Review-Url: https://codereview.chromium.org/2292973002
Cr-Commit-Position: refs/heads/master@{#39263}

The optimization is not correct for unsigned output types, and we the
overall complexity seems too high. We need to find a better way to
take into account the input/output type restrictions.

Also added a regression test for the unsigned output bug.

BUG=v8:5267,v8:5270,v8:5357
TBR=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2320013002
Cr-Commit-Position: refs/heads/master@{#39262}

The trouble here is that the type of the induction variable might be
a bit ahead of the increment (JSAdd) operation's type. When we update
the type of the increment, we might only update the induction variable
type while the JSAdd type might be stale. If the induction variable typing
needs to fall back to normal phi typing (e.g., when the increment is not
an integer anymore), it might use the stale type.

To get around this, we fake monotonicity if we fallback to normal phi
typing. Another option would be to force re-typing of the increment
operation, but that seems to be harder to maintain.

BUG=chromium:644633

Review-Url: https://codereview.chromium.org/2320803002
Cr-Commit-Position: refs/heads/master@{#39261}

This patch fixes a bunch of out-of-date TODOs, un-skips some tests
and refers to appropriate bug numbers and current specification
status where appropriate.

R=adamk

Review-Url: https://codereview.chromium.org/2319203002
Cr-Commit-Position: refs/heads/master@{#39260}

BUG=

Review-Url: https://codereview.chromium.org/2315413002
Cr-Commit-Position: refs/heads/master@{#39259}

Move it to HARMONY_STAGED bucket

Spec discussion:  https://github.com/tc39/ecma402/issues/30
It's in stage 4 and Firefox has already implemented it.

BUG=v8:5244
TEST=intl/date-format/date-format-to-parts.js
TEST=test262/intl402/DateTimeFormat/prototype/formatToParts/*

Review-Url: https://codereview.chromium.org/2317783003
Cr-Commit-Position: refs/heads/master@{#39258}

While fixing the bug, removed code duplication from super load/store
runtime calls, and inlined calls of Object::ReadAbsentProperty (left
over from strong mode).

BUG=v8:5335

Review-Url: https://codereview.chromium.org/2311413002
Cr-Commit-Position: refs/heads/master@{#39257}

This adds support for dematerialized context values as part of an
interpreted frame (similar to an FCG frame). Both frame translations
should be kept in sync as much as possible.

R=rmcilroy@chromium.org
BUG=chromium:644728

Review-Url: https://codereview.chromium.org/2313343002
Cr-Commit-Position: refs/heads/master@{#39256}

Chromium doesn't support lsan with mac's current toolchain.

BUG=chromium:644643
NOTRY=true

Review-Url: https://codereview.chromium.org/2322493002
Cr-Commit-Position: refs/heads/master@{#39255}

This yields a ~5% serialization time improvement on typical JSON-esque data.
The approach taken matches json-stringifier fairly closely.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2311063004
Cr-Commit-Position: refs/heads/master@{#39254}

Testcase regress/regress-353551 fails with stack overflow error on
ppc64, increasing stack-size to 1100 resolves the issue, but will
cause other platforms to fail similar to
https://codereview.chromium.org/2072533002.
For now, disabling the testcase on ppc64.

R=machenbach@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2314343002
Cr-Commit-Position: refs/heads/master@{#39253}

On PPC the testcase CodeSerializerLargeCodeObject fails as
the object gets allocated in the code_space section of
the heap. This is because the code_space gets expanded
successfully to 1 page size (4MB on PPC) and can accommodate
the object (size=3784608 bytes). Increasing size of the compiled
source to (5096192 bytes) so that code_space is not expanded and
the space is allocated in the Large Object space of the heap.
Testcase was added as part of https://codereview.chromium.org/2226233002

R=mstarzinger@chromium.org, bmeurer@chromium.org

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2314843003
Cr-Commit-Position: refs/heads/master@{#39252}

This patch moves the following parsing methods to ParserBase:

- ParseBlock

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2312263002
Cr-Commit-Position: refs/heads/master@{#39251}

BUG=chromium:644713
LOG=NO

Review-Url: https://codereview.chromium.org/2322453002
Cr-Commit-Position: refs/heads/master@{#39250}

Move StringToNumber builtin implementation to helper function in
CodeStubAssembler.

BUG=

Review-Url: https://codereview.chromium.org/2293943002
Cr-Commit-Position: refs/heads/master@{#39249}

This is analogous to the variable liveness analysis we do in the AstGraphBuilder, but on the bytecode registers.

BUG=

Review-Url: https://codereview.chromium.org/2307863002
Cr-Commit-Position: refs/heads/master@{#39248}

Review-Url: https://codereview.chromium.org/2319563002
Cr-Commit-Position: refs/heads/master@{#39247}

We were previously incorrectly changing:
  sub r0, 0, r1
  cmp r2, r0
  b.cond <addr>
to:
  cmn r2, r1
  b.cond <addr>

for all conditions. This is incorrect for conditions involving the C (carry)
and V (overflow) flags, and in particular in the case where r1 = INT_MIN.
The optimization is still safe to perform for Equal and NotEqual since they
do not depend on the C and V flags.

BUG=

Review-Url: https://codereview.chromium.org/2318043002
Cr-Commit-Position: refs/heads/master@{#39246}

Remove dynamic libraries that are automatically included.

BUG=chromium:644643
NOTRY=true

Review-Url: https://codereview.chromium.org/2219423002
Cr-Commit-Position: refs/heads/master@{#39245}

This implements the CompilationInfo::context explicitly instead of
delegating to the underlying ParseInfo. This is in preparation for
ParseInfo not having to store the context at all soon.

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2316083002
Cr-Commit-Position: refs/heads/master@{#39244}

This will allow getting the entire scope chain from a SharedFunctionInfo
which in turn will allow for generating bytecode when we just have the
SFI

R=verwaest@chromium.org,marja@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2271993002
Cr-Commit-Position: refs/heads/master@{#39243}

Migrate the isNaN, isFinite, Number.isFinite, Number.isInteger,
Number.isSafeInteger and Number.isNaN predicates to TurboFan
builtins and make them optimizable (for certain input types) in
JavaScript callees being optimized by TurboFan. That means both
the baseline and the optimized version is now always at maximum,
consistent performance. Especially TurboFan suffered from poor
baseline (and optimized) performance because it cannot play the
same weird tricks that Crankshaft plays for %_IsSmi.

This also adds a bunch of new tests to properly cover the use
of the Harmony predicates in optimized code.

R=franzih@chromium.org
BUG=v8:5049,v8:5267

Review-Url: https://codereview.chromium.org/2313073002
Cr-Commit-Position: refs/heads/master@{#39242}

Review-Url: https://codereview.chromium.org/2317823002
Cr-Commit-Position: refs/heads/master@{#39241}

BUG=v8:5358

Review-Url: https://codereview.chromium.org/2316973002
Cr-Commit-Position: refs/heads/master@{#39240}

Now callers of Heap::CollectGarbage* functions need to
specify the reason as an enum value instead of a string.

Subsequent CL will add stats counter for GC reason.

BUG=

Review-Url: https://codereview.chromium.org/2310143002
Cr-Commit-Position: refs/heads/master@{#39239}

The assumption that held when this DCHECK was introduced are no longer valid. Furthermore, the code below it seems to merge two non-overlapping intervals anyway.

Review-Url: https://codereview.chromium.org/2316033002
Cr-Commit-Position: refs/heads/master@{#39238}

This reverts commit 332bd5e9.

BUG=chromium:636331
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2313243002
Cr-Commit-Position: refs/heads/master@{#39237}

R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2318953003
Cr-Commit-Position: refs/heads/master@{#39236}

Various test fixes for issues that get flushed out with smaller pages.

BUG=chromium:636331
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2313273002
Cr-Commit-Position: refs/heads/master@{#39235}

In ignition, allocation site mementos were disabled when creating array
literals. Enabled them in this cl.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2294913006
Cr-Commit-Position: refs/heads/master@{#39234}

This moves scope-related logic (such as looking up variables) to Scope
where it belongs, and enables PreParser to do more Scope-related
operations in the future.

BUG=

Review-Url: https://codereview.chromium.org/2301183003
Cr-Commit-Position: refs/heads/master@{#39233}

When we parse the top-level lazily, we don't get to see eval calls in
inner scopes anyway. By never recording them, we make sure that the
script scope ends up looking the same, no matter how we parsed it.

BUG=v8:5215
R=marja@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2312903003
Cr-Commit-Position: refs/heads/master@{#39232}

Revert of Remove --ignition-staging to --ignition-osr implication. (patchset #1 id:1 of https://codereview.chromium.org/2298613003/ )

Reason for revert:
Re-enable to get new data after recent changes.

Original issue's description:
> Remove --ignition-staging to --ignition-osr implication.
>
> Ignition OSR to turbofan seems to cause instruction selector crashes
> (where instructions selector gets simplified operators, probably
> because we break the effect chain somehow).
>
> BUG=chromium:641893
>
> Committed: https://crrev.com/26df3e230ebd8c7d1cd95ea54155959eee7cb830
> Cr-Commit-Position: refs/heads/master@{#39045}

TBR=bmeurer@chromium.org,jarin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:641893

Review-Url: https://codereview.chromium.org/2318943002
Cr-Commit-Position: refs/heads/master@{#39231}

Lexically declared "arguments" in sloppy mode will throw redeclaration error
currently, this patch fixes it by delaying the declaration of arguments until we
fully parse parameter list and function body.

BUG=v8:4577
LOG=N

Committed: https://crrev.com/70a613dd0a5f5d205b46559b55702764464851fa
Review-Url: https://codereview.chromium.org/2290753003
Cr-Original-Commit-Position: refs/heads/master@{#39109}
Cr-Commit-Position: refs/heads/master@{#39230}

Revert of [heap] Switch to 500k pages (patchset #5 id:80001 of https://codereview.chromium.org/2314803002/ )

Reason for revert:
Breaks arm64 nosnap debug:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/2178

Original issue's description:
> [heap] Switch to 500k pages
>
> BUG=chromium:636331
> R=ulan@chromium.org
>
> Committed: https://crrev.com/4b618dbf8ec7f0edf377b54b48bf3c852d5e235a
> Cr-Commit-Position: refs/heads/master@{#39220}

TBR=ulan@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:636331

Review-Url: https://codereview.chromium.org/2312853005
Cr-Commit-Position: refs/heads/master@{#39229}

This is a complement to
https://codereview.chromium.org/2281523002.

The patch above reversed the order of nodes with same
latency, which caused bench_copy.js 4% regression and
bench_skinning.js 5% regression on Atom when enabling
'--turbo-instruction-scheduling' flag according to our
observation.

We submit this patch to sort the nodes with same latency
in original order. It aligns with instruction scheduling
logic before the patch above and fixes these regression.

BUG=

Review-Url: https://codereview.chromium.org/2284373002
Cr-Commit-Position: refs/heads/master@{#39228}

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2302183002
Cr-Commit-Position: refs/heads/master@{#39227}