Avoid double incrementing the variable in the U16() macro.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1431803004

Cr-Commit-Position: refs/heads/master@{#31803}

Emit an early error when BindingPatterns are used in a VariableDeclaration
or LexicalBinding without an Initializer.

BUG=v8:4532
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1416753009

Cr-Commit-Position: refs/heads/master@{#31802}

Revert of Implement flag and source getters on RegExp.prototype. (patchset #6 id:110001 of https://codereview.chromium.org/1419823010/ )

Reason for revert:
Breaks Chromium tests and blocks the roll: http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/124490

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}
>
> Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
> Cr-Commit-Position: refs/heads/master@{#31782}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1432683002

Cr-Commit-Position: refs/heads/master@{#31801}

Revert of Use in-object fields instead of private symbols for regexp slots. (patchset #4 id:60001 of https://codereview.chromium.org/1428203003/ )

Reason for revert:
A clean revert of https://codereview.chromium.org/1419823010/ was not possible because of this CL. Thus, I am also reverting this CL.

Original issue's description:
> Use in-object fields instead of private symbols for regexp slots.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/5a1e42c039ac3379ebe1e7e34fb8163e1ec1493e
> Cr-Commit-Position: refs/heads/master@{#31791}

TBR=bmeurer@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421593009

Cr-Commit-Position: refs/heads/master@{#31800}

This deprecates the ability of the raw machine assembler to utilize the
CallFunctionStub in preparation of the stub itself being deprecated. We
only used this to test instruction selection of calls to stubs that can
deoptimize, the test has been adapted.

R=verwaest@chromium.org
TEST=unittests/InstructionSelectorTest

Review URL: https://codereview.chromium.org/1408193006

Cr-Commit-Position: refs/heads/master@{#31799}

Revert of [es6] Implement destructuring binding in try/catch (patchset #3 id:40001 of https://codereview.chromium.org/1417483014/ )

Reason for revert:
MSAN errors on arm64: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/5123/

Original issue's description:
> [es6] Implement destructuring binding in try/catch
>
> The approach is to desugar
>
>   try { ... }
>   catch ({x, y}) { ... }
>
> into
>
>   try { ... }
>   catch (.catch) {
>     let x = .catch.x;
>     let y = .catch.y;
>     ...
>   }
>
> using the PatternRewriter's normal facilities. This has the side benefit
> of throwing the appropriate variable conflict errors for declarations
> made inside the catch block.
>
> No change is made to non-destructured cases, which will hopefully save
> us some work if https://github.com/tc39/ecma262/issues/150 is adopted
> in the spec.
>
> There's one big problem with this patch, which is a lack of PreParser
> support for the redeclaration errors. But it seems we're already lacking
> good PreParser support for such errors, so I'm not sure that should
> block this moving forward.
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
> Cr-Commit-Position: refs/heads/master@{#31797}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1408063013

Cr-Commit-Position: refs/heads/master@{#31798}

The approach is to desugar

  try { ... }
  catch ({x, y}) { ... }

into

  try { ... }
  catch (.catch) {
    let x = .catch.x;
    let y = .catch.y;
    ...
  }

using the PatternRewriter's normal facilities. This has the side benefit
of throwing the appropriate variable conflict errors for declarations
made inside the catch block.

No change is made to non-destructured cases, which will hopefully save
us some work if https://github.com/tc39/ecma262/issues/150 is adopted
in the spec.

There's one big problem with this patch, which is a lack of PreParser
support for the redeclaration errors. But it seems we're already lacking
good PreParser support for such errors, so I'm not sure that should
block this moving forward.

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1417483014

Cr-Commit-Position: refs/heads/master@{#31797}

Review URL: https://codereview.chromium.org/1425183003

Cr-Commit-Position: refs/heads/master@{#31796}

Port 870e908d

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1428133002

Cr-Commit-Position: refs/heads/master@{#31795}

Use the Call builtin instead, which does the right thing(TM)
always, especially since the CallFunctionStub is going away.

R=jarin@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1410853007

Cr-Commit-Position: refs/heads/master@{#31794}

Review URL: https://codereview.chromium.org/1413153013

Cr-Commit-Position: refs/heads/master@{#31793}

This removes several methods from JSFunction that just delegate to
SharedFunctionInfo. These methods are especially dangerous when they
hide the fact that they potentially affect all function instances
deriving from the same underlying SharedFunctionInfo.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1417213005

Cr-Commit-Position: refs/heads/master@{#31792}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1428203003

Cr-Commit-Position: refs/heads/master@{#31791}

The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31790}

The callees are expected to properly set the number of actual
arguments passed to the callee, which is now represented correctly
in the TurboFan graphs by a new Parameter right before the context
Parameter.  Currently this is only being used for outgoing calls.

Note that this requires disabling two of the TF code stub tests,
because of the JavaScript graphs are not automagically compatible
with abitrary (incoming) code stub interface descriptors.  If we
want to support JS code stubs at all, then we need to find a sane
way to feed in this information.

Drive-by-fix: Don't insert a direct call to a classConstructor.

R=mstarzinger@chromium.org
BUG=v8:4413, v8:4428
LOG=n

Review URL: https://codereview.chromium.org/1410633006

Cr-Commit-Position: refs/heads/master@{#31789}

BUG=

Review URL: https://codereview.chromium.org/1425403002

Cr-Commit-Position: refs/heads/master@{#31788}

Revert of [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor. (patchset #20 id:370001 of https://codereview.chromium.org/1418623007/ )

Reason for revert:
failing build bot

Original issue's description:
> [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
>
> The current implementation of classes throws the TypeError at the wrong
> point, after activating a new context when directly calling a class
> constructor. According to the spec, the TypeError has to be thrown
> in the caller context.
>
> LOG=N
> BUG=v8:4428
>
> Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
> Cr-Commit-Position: refs/heads/master@{#31786}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4428

Review URL: https://codereview.chromium.org/1415783006

Cr-Commit-Position: refs/heads/master@{#31787}

The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1412223018

Cr-Commit-Position: refs/heads/master@{#31785}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1405963011

Cr-Commit-Position: refs/heads/master@{#31784}

Cr-Commit-Position: refs/heads/master@{#31783}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31782}

Call directly into the ArgumentsAdaptorTrampoline when we call a known
JSFunction, but that actual argument count doesn't match the expected
argument count.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1417213004

Cr-Commit-Position: refs/heads/master@{#31781}

Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )

Reason for revert:
Performance issue.

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1409013006

Cr-Commit-Position: refs/heads/master@{#31780}

We don't really care about signedness when truncating to Word32.

Review URL: https://codereview.chromium.org/1417023005

Cr-Commit-Position: refs/heads/master@{#31779}

This makes the description in the README file for our test262 harness
independent of the underlying revision. The one canonical place to
mention the up-to-date revision is the DEPS file.

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1424043006

Cr-Commit-Position: refs/heads/master@{#31778}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1413033014

Cr-Commit-Position: refs/heads/master@{#31777}

This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}

Review URL: https://codereview.chromium.org/1414403003

Cr-Commit-Position: refs/heads/master@{#31775}

Adds support for calling JS runtime functions. Also changes the bytecode
array builder to allow calling functions with an invalid argument
register if the call takes no arguments.

Adds the bytecode CallJSRuntime.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410003003

Cr-Commit-Position: refs/heads/master@{#31774}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31773}

Use the type specified for StoreField and StoreElement to check whether
we are storing a TaggedSigned value, and skip the write barrier for the
write completely in that case.  Also make sure to set that field type
appropriately for JSGlobalObjectSpecialization.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410743009

Cr-Commit-Position: refs/heads/master@{#31772}

We don't need to distinguish between signed and unsigned integral
representations in the big boy type system. It actually even hurts
in some cases. The representation is only about the way the values
are mapped to bits in memory/registers, but the interpretation of
the bits is specified by the semantic dimension.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1416953006

Cr-Commit-Position: refs/heads/master@{#31771}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1422623013

Cr-Commit-Position: refs/heads/master@{#31770}

We used to mark a block as needing frame based solely on
the spill list. With splintering, that is not entirely
accurate. With this change, for ranges that spill only in
deferred blocks, we mark the start of each block in which a
child range spills as needing a frame.

BUG=v8:4533
LOG=n

Review URL: https://codereview.chromium.org/1408183007

Cr-Commit-Position: refs/heads/master@{#31769}

Rolling v8/build/gyp to 2c1e6cced23554ce84806e570acea637f6473afc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1413923012

Cr-Commit-Position: refs/heads/master@{#31768}

The "harmony"-prefixed files have been included in the snapshot for
several releases now, and were only separate originally to enable
loading them via a runtime flag. This patch simply merges them into
the main implementation files for Arrays and TypedArrays, respectively.

Review URL: https://codereview.chromium.org/1416243007

Cr-Commit-Position: refs/heads/master@{#31767}

BUG=

Review URL: https://codereview.chromium.org/1430943004

Cr-Commit-Position: refs/heads/master@{#31766}

Revert of [heap] Turn on parallel compaction (patchset #1 id:1 of https://codereview.chromium.org/1364693002/ )

Reason for revert:
Fails on gc stress
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/157/

Original issue's description:
> [heap] Turn on parallel compaction
>
> R=hpayer@chromium.org
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/04db5bfa915766b228218ddc748af308b57ae8ea
> Cr-Commit-Position: refs/heads/master@{#31763}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1424313008

Cr-Commit-Position: refs/heads/master@{#31765}

Only cast to integer with xor (closer to the spec which allows only ~~).
Check type matching on the bitwise operations.
Prevent mixing of types with the arthimetic operations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1405383007

Cr-Commit-Position: refs/heads/master@{#31764}