There's no need for a dedicated ToBoolean builtin in JavaScript, since
ToBoolean(x) can easily be expressed in JavaScript as !!x, which has the
additional advantage that the compilers are able to properly optimize
that (out of the box).

Review URL: https://codereview.chromium.org/1400463002

Cr-Commit-Position: refs/heads/master@{#31172}

For property cells with cell type kConstantType, we can compute an
appropriate JavaScript type based on the current value of that cell.
Numbers cannot use Type::Of here, because the type might be too precise,
so we handle smi and heap number specially.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1400483002

Cr-Commit-Position: refs/heads/master@{#31171}

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1394753002

Cr-Commit-Position: refs/heads/master@{#31170}

Repository URL changed in chromium.

TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/1396773002

Cr-Commit-Position: refs/heads/master@{#31169}

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1398603002

Cr-Commit-Position: refs/heads/master@{#31168}

Revert of Reland: Introduce a V8_NORETURN macro and use it to make GCC 4.9.2 happy again. (patchset #3 id:40001 of https://codereview.chromium.org/1383053005/ )

Reason for revert:
Breaks Arm debug.

Original issue's description:
> Reland: Introduce a V8_NORETURN macro and use it to make GCC 4.9.2 happy again.
>
> Without that, it has a few false positives about out-of-bounds array accesses.
> Also makes the clang static-analyzer happy.
>
> Original code review from Sven Panne:
> https://codereview.chromium.org/790723002/
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_arm_dbg,v8_linux_arm64_dbg,v8_mac64_dbg,v8_win_compile_dbg
>
> Committed: https://crrev.com/93ae81101af68d81b7af84ea4046ea849e605116
> Cr-Commit-Position: refs/heads/master@{#31163}

TBR=jochen@chromium.org,karl@skomski.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1398643002

Cr-Commit-Position: refs/heads/master@{#31167}

Implements support for declaring global variables. Also adds support for loading
from and storing to both global and unallocated global variables.  Adds the
following bytecodes:
 - StoreGlobal
 - LoadContextSlot

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1378523005

Cr-Commit-Position: refs/heads/master@{#31166}

This patch brings test262 up to the latest version on GitHub. Some
highlights from new failures are:
- Reflect
- Default parameters
- Case conversion edge cases

R=adamk

Review URL: https://codereview.chromium.org/1391793002

Cr-Commit-Position: refs/heads/master@{#31165}

Add a flag to explicitly filter scripts in ignition and use it for the test262
variant. The previous approach of overloading ignition-filter meant that only
top-level code was getting compiled through ignition.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1396493002

Cr-Commit-Position: refs/heads/master@{#31164}

Without that, it has a few false positives about out-of-bounds array accesses.
Also makes the clang static-analyzer happy.

Original code review from Sven Panne:
https://codereview.chromium.org/790723002/

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_arm_dbg,v8_linux_arm64_dbg,v8_mac64_dbg,v8_win_compile_dbg

Review URL: https://codereview.chromium.org/1383053005

Cr-Commit-Position: refs/heads/master@{#31163}

Use the simple macro version of {Min, Max} where possible to
improve performance

Follow-up to CR: https://codereview.chromium.org/1331993004

BUG=

Review URL: https://codereview.chromium.org/1390023003

Cr-Commit-Position: refs/heads/master@{#31162}

This removes stale strings from the bailout-reason.h file that are no
longer being used and hence only eat up space in the binary.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1391973002

Cr-Commit-Position: refs/heads/master@{#31161}

In ES5, ToObject was called on elements before invoking the
.toLocaleString() method on them. ES2015 specifies that ToObject is
not called. A test262 test verifies this change. This patch
implements the new ES2015 behavior. It is verified by the test262 test
built-ins/Array/prototype/toLocaleString/primitive_this_value_getter

R=adamk

Review URL: https://codereview.chromium.org/1390893003

Cr-Commit-Position: refs/heads/master@{#31160}

In ES2015, section 20.3.1.15, TimeClip (an internal algorihtm which is
called when normalizing Date representations) is specified to add 0
to its result, which converts -0 into +0. This patch adds that conversion
to the Date code. It is verified by the test262 test
built-ins/Date/TimeClip_negative_zero

R=adamk

Review URL: https://codereview.chromium.org/1387293002

Cr-Commit-Position: refs/heads/master@{#31159}

BUG=
R=
LOG=N

Review URL: https://codereview.chromium.org/1392763003

Cr-Commit-Position: refs/heads/master@{#31158}

This removes the include of compiler.h from all our assemblers, which
was only needed for the SourcePosition class.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1397493002

Cr-Commit-Position: refs/heads/master@{#31157}

Calling LowerInlineAllocationLimit from the bottom of Heap::Scavenge seems to be
a no-op.

  new_space_.LowerInlineAllocationLimit(
      new_space_.inline_allocation_limit_step());

LowerInlineAllocatoinLimit does the following things:

1. Set the inline_allocation_limit_step_ to the passed in value. No-op.
2. Calls UpdateInlineAllocationLimit(0). This is unnecessary here as it has
   already been called when new_space_.ResetAllocationInfo was called above.
3. Sets top_on_previous_step_. This again is unnecessary as it gets reached by
   ResetAllocationInfo as well.

BUG=
R=hpayer@chromium.org,ulan@chromium.org

Review URL: https://codereview.chromium.org/1390013002

Cr-Commit-Position: refs/heads/master@{#31156}

NOTRY=true

Review URL: https://codereview.chromium.org/1393713004

Cr-Commit-Position: refs/heads/master@{#31155}

Previously, arrow function scopes had a separate ScopeType. However,
Scope::DeserializeScopeChain() erroneously deserialized ARROW_SCOPE
ScopeInfos as FUNCTION_SCOPE. This could lead to bugs such as the
attached one, where "super" was disallowed where it should have
been allowed.

This patch utilizes the Scope's FunctionKind to distinguish arrow
functions from others. Besides fixing the above bug, this also
simplifies code in various places that had to deal with two different
ScopeTypes both of which meant "function".

BUG=v8:4466
LOG=n

Review URL: https://codereview.chromium.org/1386253002

Cr-Commit-Position: refs/heads/master@{#31154}

This makes it explicit when the --ignition-filter pattern should be
applied to the script name instead of the function name by using a
proper "s:{name}" pattern. It also hardcodes it to be a prefix match
instead of an exact match, because that is all we need for test262.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1389353002

Cr-Commit-Position: refs/heads/master@{#31153}

Allow access to Array Iterator through the API, in order to simplify
setting up interfaces which use these methods. This applies to
WebIDL interfaces with "length" attributes returning integer types and
a getter taking an unsigned long type.

BUG=
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1378403004

Cr-Commit-Position: refs/heads/master@{#31152}

NOTRY=true

Review URL: https://codereview.chromium.org/1395503002

Cr-Commit-Position: refs/heads/master@{#31151}

This separates the core machinery and the heuristics involved with
inlining functions calls. So far the heuristic only respects our
%SetForceInlineFlag hint, but it will the place where general inlining
heuristics can live without impeding clarity of the core machinery.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1391903002

Cr-Commit-Position: refs/heads/master@{#31150}

Untangles committed memory from capacity in a given space and unifies accounting
for all spaces.

Pre-work for parallel compaction.

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1388383002

Cr-Commit-Position: refs/heads/master@{#31149}

Introduce a new JSGlobalSpecialization advanced reducer that runs
during the initial inlining and context specialization, and specializes
the graph to the globals of the native context.  Currently we assume
that we do not inline cross native context, but long-term we will grab
the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
new global load/store ICs that are currently in the workings), and then
this whole specialization will be fully compositional even across
cross-context inlining.

Note that we cannot really handle most of the stores to global object
property cells because TurboFan doesn't have a mechanism to enforce
certain representations.  Also note that we cannot yet fully benefit
from the type feedback collected on the global object property cells,
because the type system cannot deal with maps in a reasonable way.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
Cr-Commit-Position: refs/heads/master@{#31139}

Review URL: https://codereview.chromium.org/1387393002

Cr-Commit-Position: refs/heads/master@{#31148}

This seems to be triggered now with global object specialization.

TEST=mjsunit/regress/regress-crbug-450960
TBR=mstarzinger@chromium.org
BUG=v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1388403002 .

Cr-Commit-Position: refs/heads/master@{#31147}

- Reflect.deleteProperty
- Reflect.get
- Reflect.has
- Reflect.isExtensible

Reflect.get doesn't support the receiver argument yet, and
some of the others don't support proxies yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1379313002

Cr-Commit-Position: refs/heads/master@{#31146}

R=mstarzinger@chromium.org
BUG=chromium:540593
LOG=n

Review URL: https://codereview.chromium.org/1395453002

Cr-Commit-Position: refs/heads/master@{#31145}

Revert of [turbofan] Add initial support for global specialization. (patchset #4 id:60001 of https://codereview.chromium.org/1387393002/ )

Reason for revert:
Breaks GC stress: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1984/steps/Bisect%20c5528ac1.Retry/logs/regress-crbug-450960

Original issue's description:
> [turbofan] Add initial support for global specialization.
>
> Introduce a new JSGlobalSpecialization advanced reducer that runs
> during the initial inlining and context specialization, and specializes
> the graph to the globals of the native context.  Currently we assume
> that we do not inline cross native context, but long-term we will grab
> the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
> new global load/store ICs that are currently in the workings), and then
> this whole specialization will be fully compositional even across
> cross-context inlining.
>
> Note that we cannot really handle most of the stores to global object
> property cells because TurboFan doesn't have a mechanism to enforce
> certain representations.  Also note that we cannot yet fully benefit
> from the type feedback collected on the global object property cells,
> because the type system cannot deal with maps in a reasonable way.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
> Cr-Commit-Position: refs/heads/master@{#31139}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1390073004

Cr-Commit-Position: refs/heads/master@{#31144}

Thus TypeFeedbackMetadata can now be shared between different native contexts.

Review URL: https://codereview.chromium.org/1384673002

Cr-Commit-Position: refs/heads/master@{#31143}

Adds support for compiling top level code to bytecode to be run in the
interpreter.

Also moves PassesFilter to String:: so that it can be used to filter top
level script names as well as functions (used in
https://codereview.chromium.org/1379093002/)

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1372293005

Cr-Commit-Position: refs/heads/master@{#31142}

NOTRY=true

Review URL: https://codereview.chromium.org/1394453002

Cr-Commit-Position: refs/heads/master@{#31141}

The roll ref is no longer used because we
simply roll the lkgr ref.

LOG=N
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1391153002

Cr-Commit-Position: refs/heads/master@{#31140}

Introduce a new JSGlobalSpecialization advanced reducer that runs
during the initial inlining and context specialization, and specializes
the graph to the globals of the native context.  Currently we assume
that we do not inline cross native context, but long-term we will grab
the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
new global load/store ICs that are currently in the workings), and then
this whole specialization will be fully compositional even across
cross-context inlining.

Note that we cannot really handle most of the stores to global object
property cells because TurboFan doesn't have a mechanism to enforce
certain representations.  Also note that we cannot yet fully benefit
from the type feedback collected on the global object property cells,
because the type system cannot deal with maps in a reasonable way.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1387393002

Cr-Commit-Position: refs/heads/master@{#31139}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1388343002

Cr-Commit-Position: refs/heads/master@{#31138}

Revert of improve perf_basic_prof filename reporting (patchset #1 id:1 of https://codereview.chromium.org/1388543002/ )

Reason for revert:
Suspected to cause crbug.com/539892

Original issue's description:
> improve perf_basic_prof filename reporting
>
> The buffer used for appending filenames to the string printed to the
> perf_basic_prof log was unnecessarily too small. Bump it up to be at least
> kUtf8BufferSize.
>
> Truncation of filenames makes it really hard to work with profiles gathered on
> Node.js. Because of the way Node.js works, you can have node module dependencies
> in deeply nested directories. The last thing you want when investigating a
> performance problem is to have script names be truncated.
>
> This patch is a stop-gap. Ideally, I want no truncation of the filename at all
> and use a dynamically growing buffer. That would be a larger change, and I
> wanted to have a quick fix available that can be back-ported to Node.js LTS
> release.
>
> R=yangguo@chromium.org,yurys@chromium.org
> BUG=
>
> Committed: https://crrev.com/03ef3cd004c2fd31ae7e48772f106df67b8c2feb
> Cr-Commit-Position: refs/heads/master@{#31092}

TBR=yangguo@chromium.org,yurys@chromium.org,ofrobots@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1390923004

Cr-Commit-Position: refs/heads/master@{#31137}

BUG=

Review URL: https://codereview.chromium.org/1393833002

Cr-Commit-Position: refs/heads/master@{#31136}

Optimizing global constants such as "NaN", "Infinity" and "undefined" is
best performed during graph building. Then the optimization and lowering
passes only need to deal with real loads in case of JSLoadGlobal.

R=mstarzinger@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1384953002

Cr-Commit-Position: refs/heads/master@{#31135}

Adds support for strict mode load / store ICs and cleans up BinaryOp and
CompareOp to only trigger an UNIMPLEMENTED abort if called with STRONG
mode (which is the only language mode which has different compare/binary ops.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1385623002

Cr-Commit-Position: refs/heads/master@{#31134}

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1378693004

Cr-Commit-Position: refs/heads/master@{#31133}