- Eliminate stubs with a variable number of arguments.
  (That only worked due to their very limited use. These
   stubs' interface descriptors were basically lying
   about their number of args, which will fail when used
   generically.)
- Fix all CallApi*Stubs' interface descriptors to no
  longer lie about their arguments.
- Unify CallApi*Stub, for * in Function, Accessor,
  FunctionWithFixedArgs.
  (Since these are now all doing the same thing.)
- Rename the unified stub (and interface descriptors) to
  *ApiCallback*, since that's really what they're doing.
- Refuse inlining an API callback if its number of
  parameters exceeds the supported number of args.

BUG=

Committed: https://crrev.com/d238b953a474272c0e3ea22ef6a9b63fa9729340
Cr-Commit-Position: refs/heads/master@{#34614}

Review URL: https://codereview.chromium.org/1748123003

Cr-Commit-Position: refs/heads/master@{#34627}

The CharacterRange constructor checks the input for validity. However,
CharacterRange::Singleton also uses the constructor and may have
kEndMarker as input, causing the check to fail.

The solution is to move the check to CharacterRange::Range and
consistently use it across the code base.

R=jkummerow@chromium.org
BUG=chromium:593282
LOG=N

Review URL: https://codereview.chromium.org/1776013003

Cr-Commit-Position: refs/heads/master@{#34626}

We have to do a Smi check on the frame marker, not just compare
against a single frame type.

BUG=chromium:593332
LOG=n
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/1777913002

Cr-Commit-Position: refs/heads/master@{#34625}

Revert of Rework CallApi*Stubs. (patchset #5 id:100001 of https://codereview.chromium.org/1748123003/ )

Reason for revert:
Breaks Chromium.

Original issue's description:
> Rework CallApi*Stubs.
>
> - Eliminate stubs with a variable number of arguments.
>   (That only worked due to their very limited use. These
>    stubs' interface descriptors were basically lying
>    about their number of args, which will fail when used
>    generically.)
> - Fix all CallApi*Stubs' interface descriptors to no
>   longer lie about their arguments.
> - Unify CallApi*Stub, for * in Function, Accessor,
>   FunctionWithFixedArgs.
>   (Since these are now all doing the same thing.)
> - Rename the unified stub (and interface descriptors) to
>   *ApiCallback*, since that's really what they're doing.
> - Refuse inlining an API callback if its number of
>   parameters exceeds the supported number of args.
>
> BUG=
>
> Committed: https://crrev.com/d238b953a474272c0e3ea22ef6a9b63fa9729340
> Cr-Commit-Position: refs/heads/master@{#34614}

TBR=danno@chromium.org,jkummerow@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1775933005

Cr-Commit-Position: refs/heads/master@{#34624}

Avoid hard-coding fp offset to marker in StandardFrame::IterateCompiledFrame.

R=danno@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1775193002

Cr-Commit-Position: refs/heads/master@{#34623}

Parallelize test/mjsunit/es6/tail-call-megatest.js in order to avoid timeouts on slow architectures.

Review URL: https://codereview.chromium.org/1778663004

Cr-Commit-Position: refs/heads/master@{#34622}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1775353003

Cr-Commit-Position: refs/heads/master@{#34621}

I used a new category "v8.runtime" and all events are disabled by
default, so there shouldn't be any perf impact.

BUG=none
R=fmeawad@chromium.org,cbruni@chromium.org

Review URL: https://codereview.chromium.org/1770353002

Cr-Commit-Position: refs/heads/master@{#34620}

BUG=

Review URL: https://codereview.chromium.org/1780663002

Cr-Commit-Position: refs/heads/master@{#34619}

Implementation new test cases for conversion instructions Cvt_s_uw,
Cvt_s_ul, Cvt_d_ul and truncate instructions Trunc_uw_s, Trunc_ul_s,
Trunc_ul_d, Trunc_l_d, Trunc_l_ud, Trunc_w_d.

TEST=cctest/test-macro-assembler-mips/cvt_s_w_Trunc_uw_s, others
     cctest/test-macro-assembler-mips64/Cvt_s_uw_Trunc_uw_s, others
BUG=

Review URL: https://codereview.chromium.org/1747863002

Cr-Commit-Position: refs/heads/master@{#34618}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1778863002

Cr-Commit-Position: refs/heads/master@{#34617}

If left or right is guaranteed at compile-time to be an undetectable object, use HIsUndetectableAndBranch on the other side.

BUG=

Review URL: https://codereview.chromium.org/1775163005

Cr-Commit-Position: refs/heads/master@{#34616}

BUG=chromium:592341
LOG=n

Review URL: https://codereview.chromium.org/1776013002

Cr-Commit-Position: refs/heads/master@{#34615}

- Eliminate stubs with a variable number of arguments.
  (That only worked due to their very limited use. These
   stubs' interface descriptors were basically lying
   about their number of args, which will fail when used
   generically.)
- Fix all CallApi*Stubs' interface descriptors to no
  longer lie about their arguments.
- Unify CallApi*Stub, for * in Function, Accessor,
  FunctionWithFixedArgs.
  (Since these are now all doing the same thing.)
- Rename the unified stub (and interface descriptors) to
  *ApiCallback*, since that's really what they're doing.
- Refuse inlining an API callback if its number of
  parameters exceeds the supported number of args.

BUG=

Review URL: https://codereview.chromium.org/1748123003

Cr-Commit-Position: refs/heads/master@{#34614}

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1773173005

Cr-Commit-Position: refs/heads/master@{#34613}

This CL allows the sweeper to free up all memory >= free list item size (3 words). This may reduce memory consumption (especially in map space), but may be worse for allocation order as soon as we start using the tiny category.

This CL is just a first step in the right direction. A follow up CL will add customizable free list categories for each old space.

BUG=chromium:587026
LOG=n

Review URL: https://codereview.chromium.org/1774953003

Cr-Commit-Position: refs/heads/master@{#34612}

BUG=
LOG=N
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1777873003

Cr-Commit-Position: refs/heads/master@{#34611}

In case when F was called with incompatible number of arguments (and therefore
the arguments adator frame was created), F inlines a tail call of G which then
deopts the deoptimizer should also remove the arguments adaptor frame for F.

This CL adds required machinery to the deoptimizer.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1768263004

Cr-Commit-Position: refs/heads/master@{#34610}

The current implementation does not consider the case when the context of
the control scope and the current context differ. It is possible that they are
different in some cases for example: with statements. This cl fixes this.

BUG=v8:4280,v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1768123002

Cr-Commit-Position: refs/heads/master@{#34609}

According to https://www.w3.org/TR/html5/obsolete.html#dom-document-all,
comparisons of document.all to other values such as strings or objects,
are unaffected. In fact document.all only gets special treatment in
comparisons with null or undefined according to HTML. Especially setting
the undetectable doesn't make two distinct JSReceivers equal.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1774273002

Cr-Commit-Position: refs/heads/master@{#34608}

After fixing the memory barrier for maps (https://codereview.chromium.org/1714513003), we are using a temp register for the map case. The temp register should not be aliased with the stored value (otherwise we perform the mem barrier check with a wrong value). This CL makes sure it is not aliased.

BUG=chromium:590074
LOG=n

Review URL: https://codereview.chromium.org/1775083002

Cr-Commit-Position: refs/heads/master@{#34607}

With this, the test runner automatically merges sancov
files after testing. There's no need to do this by some
external infrastructure.

In a future CL, we could even merge during testing to lift
harddisk pressure.

BUG=chromium:568949
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1776123002

Cr-Commit-Position: refs/heads/master@{#34606}

Cr-Commit-Position: refs/heads/master@{#34605}

Rolling v8/tools/clang to 59675c1e00cb17f347eb6da235b3266697b4521d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1775313002

Cr-Commit-Position: refs/heads/master@{#34604}

This CL modifies the following to be LEB128:
* Function table indices
* Import table signature indices
* Export table function indices
* Function signature param count
* br/br_if break depth
* br_table target count
* block/loop expression count

Still to do:
* Import/export names (LEB128 count + inline data)
* Data segments (LEB128 offset + size + inline data)
* Function header stuff (should seperate into function sig and body sections)
* Memory access alignment + offset (still discussing)

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1775873002

Cr-Commit-Position: refs/heads/master@{#34603}

This mechanism was used to ensure that functions ended up as constants on the map of prototypes defined using object literals, e.g.,:

function.prototype = {
  method: function() { ... }
}

Nowadays we treat prototypes specially, and make all their functions constants when an object turns prototype. Hence this special custom code isn't necessary anymore.

This also affects boilerplates that do not become prototypes. Their functions will not be constants but fields instead. Calling their methods will slow down. However, multiple instances of the same boilerplate will stay monomorphic. We'll have to see what the impact is for such objects, but preliminary benchmarks do not show this as an important regression.

BUG=chromium:593008
LOG=n

Review URL: https://codereview.chromium.org/1772423002

Cr-Commit-Position: refs/heads/master@{#34602}

A previous spec compliance fix for TypedArrays caused a ~4x performance
regression. This patch removes the regression by calling out
to a path within the runtime which implements array copying more
efficiently.

BUG=chromium:592007
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1767893002

Cr-Commit-Position: refs/heads/master@{#34601}

R=binji@chromium.org,dschuff@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1780483002

Cr-Commit-Position: refs/heads/master@{#34600}

The initial species protector hooked into property declaration in an
incomplete place, and missed definitions of accessors. This patch repairs
them by calling out to update the protector from an additional location.

R=adamk
CC=verwaest,cbruni
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1746323002

Cr-Commit-Position: refs/heads/master@{#34599}

The below instructions were fixed so that the produced condition
codes in simulator matched behaviour in native s390 CPUs:

CFDBR
CGDBR
CGEBR
CFEBR
CLFDBR
CLGDBR
CLGEBR

Also implemented the CLFEBR instruction in s390 simulator.

(Copypaste of 1763663003, which was pointing at wrong branch - should be master, not lkgr)

R=danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org,joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com,jyan@ca.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1773813002

Cr-Commit-Position: refs/heads/master@{#34598}

We have compatibility workarounds to return 'undefined' on accessors
to RegExp.prototype. This patch adds two UseCounters for two categories
of this non-spec-compliant path:
- source
- ignorecase, multiline, global

R=yangguo
BUG=chromium:581577
LOG=Y

Review URL: https://codereview.chromium.org/1762423002

Cr-Commit-Position: refs/heads/master@{#34597}

Also move GetProperty with string-name to JSReceiver

BUG=

Review URL: https://codereview.chromium.org/1775973002

Cr-Commit-Position: refs/heads/master@{#34596}

BUG=chromium:589679
LOG=N

Review URL: https://codereview.chromium.org/1771323003

Cr-Commit-Position: refs/heads/master@{#34595}

This adds the number of properties to be expected within the boilerplate
object for object literals to the TurboFan IR. The reason is that this
length can no longer be easily inferred from just the constants array.
The length is potentially non-zero for empty object literals and might
also diverge in the presence of constant functions or duplicate property
names.

For future safety and for symmetry reasons, the same change was applied
to array literals as well, even though inferring the length from the
constant elements is still possible there.

R=verwaest@chromium.org
BUG=chromium:593008
LOG=n

Review URL: https://codereview.chromium.org/1772803003

Cr-Commit-Position: refs/heads/master@{#34594}

  port 2aae579c (r34566)

  original commit message:
  In case when F tail calls G we should also remove the potential arguments adaptor frame for F.

  This CL introduces two new machine instructions ArchTailCallCodeObjectFromJSFunction and ArchTailCallJSFunctionFromJSFunction which (unlike existing ArchTailCallCodeObject and ArchTailCallJSFunction)
  also drop arguments adaptor frame if it exists right before jumping to the target function.

BUG=

Review URL: https://codereview.chromium.org/1777563002

Cr-Commit-Position: refs/heads/master@{#34593}

R=danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org,joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1768383002

Cr-Commit-Position: refs/heads/master@{#34592}

  port ddc626e1 (r34546)

  original commit message:
  I64Shl is lowered to a new turbofan operator, WasmWord64Shl. The new
  operator takes 3 inputs, the low-word input, the high-word input, and
  the shift, and produces 2 output, the low-word output and the high-word
  output.

  At the moment I implemented the lowering only for ia32, but I think the
  CL is already big enough. I will add the other platforms in separate
  CLs.

BUG=

Review URL: https://codereview.chromium.org/1773083002

Cr-Commit-Position: refs/heads/master@{#34591}

  port 22938040 (r34542)

  original commit message:
  HInvokeFunction and HApplyArguments instructions now support tail calling.

  Inlining of calls at tail position is not supported yet and therefore still disabled.

  The tail-call-megatest was modified so that the usages of "arguments" object do not disable Crankshaft.

BUG=

Review URL: https://codereview.chromium.org/1767343003

Cr-Commit-Position: refs/heads/master@{#34590}

Port 2aae579c

Original commit message:
    In case when F tail calls G we should also remove the potential arguments adaptor frame for F.

    This CL introduces two new machine instructions ArchTailCallCodeObjectFromJSFunction and
    ArchTailCallJSFunctionFromJSFunction which (unlike existing ArchTailCallCodeObject and
    ArchTailCallJSFunction) also drop arguments adaptor frame if it exists right before jumping
    to the target function.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1773053002

Cr-Commit-Position: refs/heads/master@{#34589}

Port ddc626e1

Original commit message:
    I64Shl is lowered to a new turbofan operator, WasmWord64Shl. The new
    operator takes 3 inputs, the low-word input, the high-word input, and
    the shift, and produces 2 output, the low-word output and the high-word
    output.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1765383004

Cr-Commit-Position: refs/heads/master@{#34588}