We currently use the outdated contexts list provided by the serializer
to update the receiver (the global proxy) in script contexts. However,
this is not actually necessary, since the global proxy is passed to the
deserializer and replaced as we deserialize.

Originally, the outdated contexts list is to update the global object
field in contexts. This was necessary since at the time the deserializer
creates the native context, the global object has not yet been created.
But the global proxy already exists.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1488873004

Cr-Commit-Position: refs/heads/master@{#32483}

Port 2f559f21

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1490923004

Cr-Commit-Position: refs/heads/master@{#32482}

Port 66d5a9df

Original commit message:
    CallIC and CallConstructStub look so alike, at least in the feedback
    they gather even if the implementation differs...and CallIC has such
    a nice way of surfacing the feedback (CallICNexus), that there is a
    request to make CallConstructStub look analogous. Enter ConstructICStub.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1485303002

Cr-Commit-Position: refs/heads/master@{#32481}

Port d2f78c6b

Original commit message:
    This becomes visible if an exception is thrown by the constructor.
    We do this on "new Array(3.5)", throwing a RangeError.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1484423003

Cr-Commit-Position: refs/heads/master@{#32480}

TEST=unittests/InstructionSelectorTest.Word(32|64)AndToClearBits
BUG=

Review URL: https://codereview.chromium.org/1485023004

Cr-Commit-Position: refs/heads/master@{#32479}

Xori instruction can only have unisgned 16-bit immediates for right input,
as such it is not suitable for bit negation on mips.

TEST=unittests/InstructionSecetorTest.Word(32|64)XorMinusOneWithParameter
BUG=

Review URL: https://codereview.chromium.org/1485833003

Cr-Commit-Position: refs/heads/master@{#32478}

BUG=v8:4585
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1488043002

Cr-Commit-Position: refs/heads/master@{#32477}

This becomes visible if an exception is thrown by the constructor.
We do this on "new Array(3.5)", throwing a RangeError.

BUG=

Review URL: https://codereview.chromium.org/1483053004

Cr-Commit-Position: refs/heads/master@{#32476}

Object.prototype.hasOwnProperty should use JSReceiver::HasOwnProperty for
proxies.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1480213004

Cr-Commit-Position: refs/heads/master@{#32475}

Adds implementation and tests for LdaContextSlot, StaeContextSlot, PushContext,
and PopContext to bytecode graph builder

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1489863002

Cr-Commit-Position: refs/heads/master@{#32474}

proxies.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1484313003

Cr-Commit-Position: refs/heads/master@{#32473}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1492433003

Cr-Commit-Position: refs/heads/master@{#32472}

LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1481383003

Cr-Commit-Position: refs/heads/master@{#32471}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1479233002

Cr-Commit-Position: refs/heads/master@{#32470}

Native scripts must not accidentally pollute the global object.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1490783002

Cr-Commit-Position: refs/heads/master@{#32469}

This moves the bailout for functions containing new.target variable to
the correct place so that Crankshaft doesn't accidentally inline such
functions, yielding an "undefined" new.target value all the time.

R=bmeurer@chromium.org
TEST=mjsunit/es6/regress/regress-inlined-new-target

Review URL: https://codereview.chromium.org/1484163003

Cr-Commit-Position: refs/heads/master@{#32468}

Remove two unused fields.
Define register codes the same way register names are defined and eliminate static methods.
#error if target isn't defined.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1482963003

Cr-Commit-Position: refs/heads/master@{#32467}

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1482283002

Cr-Commit-Position: refs/heads/master@{#32466}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1483973002

Cr-Commit-Position: refs/heads/master@{#32465}

Revert of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1486963002/ )

Reason for revert:
Maybe causing problems

Original issue's description:
> [CQ] Update proto format to fix triggered builders.
>
> Depends on https://chromereviews.googleplex.com/319777013/
>
> BUG=chromium:561530
> LOG=n
> TBR=sergiyb@chromium.org, tandrii@chromium.org
> NOTRY=true
>
> Committed: https://crrev.com/51d6d619330080a76c5bc7a2ebdafebc6a808aa8
> Cr-Commit-Position: refs/heads/master@{#32453}

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1485813004

Cr-Commit-Position: refs/heads/master@{#32464}

Revert of [heap] Remove eager shortcut in JSFunction visitor. (patchset #1 id:1 of https://codereview.chromium.org/1476223002/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Remove eager shortcut in JSFunction visitor.
>
> This removes an optimization in the static JSFunction visitor that
> eagerly marked through to the SharedFunctionInfo for code flushing
> candidates. This causes all processing in VisitJSFunction to be
> side-stepped and hence might cause leaks.
>
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/a29f0576c32e8fda90bf7ab19c6d170568150a7f
> Cr-Commit-Position: refs/heads/master@{#32332}

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1488063002

Cr-Commit-Position: refs/heads/master@{#32463}

Revert of [heap] Refactor evacuation for young and old gen into visitors. (patchset #5 id:80001 of https://codereview.chromium.org/1470253002/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Refactor evacuation for young and old gen into visitors.
>
> Create a visitor for evacuating objects for young and old generation. This is
> the first step of preparing a task to process, both,  newspace and oldspace
> pages in parallel.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/138d9bae5d7014e0d205634a49b5eac3697744c8
> Cr-Commit-Position: refs/heads/master@{#32349}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1483393002

Cr-Commit-Position: refs/heads/master@{#32462}

Revert of [heap] Cleanup mark bit usage. (patchset #1 id:1 of https://codereview.chromium.org/1474203003/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Cleanup mark bit usage.
>
> BUG=
>
> Committed: https://crrev.com/5874ac783ff9bc4bb4b2fda81f5077f06619f96c
> Cr-Commit-Position: refs/heads/master@{#32362}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1490753003

Cr-Commit-Position: refs/heads/master@{#32461}

Revert of [heap] Unify evacuating an object for new and old generation. (patchset #2 id:20001 of https://codereview.chromium.org/1481873002/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Unify evacuating an object for new and old generation.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/afb8bcce8ba889280ed747eb218d287ddd233b4a
> Cr-Commit-Position: refs/heads/master@{#32365}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1483963004

Cr-Commit-Position: refs/heads/master@{#32460}

Revert of [heap] Remove live weak cells from weak cell list when finalizing incremental marking. (patchset #3 id:40001 of https://codereview.chromium.org/1474303002/ )

Reason for revert:
Still investigating bad canary.

Original issue's description:
> [heap] Remove live weak cells from weak cell list when finalizing incremental marking.
>
> BUG=chromium:548562
> LOG=n
>
> Committed: https://crrev.com/6190c608c8f3ced0f00ff53965e115b78646cecd
> Cr-Commit-Position: refs/heads/master@{#32372}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1481383004

Cr-Commit-Position: refs/heads/master@{#32459}

R=machenbach@chromium.org
BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1486083002

Cr-Commit-Position: refs/heads/master@{#32458}

R=rossberg
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1481103002

Cr-Commit-Position: refs/heads/master@{#32457}

R=jarin@chromium.org
BUG=chromium:563929
LOG=n

Review URL: https://codereview.chromium.org/1483343002

Cr-Commit-Position: refs/heads/master@{#32456}

Revert of [turbofan] Ship TurboFan with new.target references. (patchset #1 id:1 of https://codereview.chromium.org/1482733002/ )

Reason for revert:
Tanks sunspider/date-format-tofte because of the Date constructor being turbofanned.

Original issue's description:
> [turbofan] Ship TurboFan with new.target references.
>
> This correctly marks functions containing a new.target reference as
> being disabled with Crankshaft, which would have bailed out anyways.
> Also note that this will trigger TurboFan for such functions and hence
> widens the TurboFan intake valve.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/2ec6fcd1520bb8a09c9924ac5498eb9b437670b0
> Cr-Commit-Position: refs/heads/master@{#32444}

TBR=bmeurer@chromium.org,rossberg@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1489833002

Cr-Commit-Position: refs/heads/master@{#32455}

The fix is to bail out of compilation in that case.

BUG=chromium:551287
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1483373002

Cr-Commit-Position: refs/heads/master@{#32454}

Depends on https://chromereviews.googleplex.com/319777013/

BUG=chromium:561530
LOG=n
TBR=sergiyb@chromium.org, tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1486963002

Cr-Commit-Position: refs/heads/master@{#32453}

CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that there is a request to make CallConstructStub look analogous. Enter ConstructICStub.

BUG=

Review URL: https://codereview.chromium.org/1476413003

Cr-Commit-Position: refs/heads/master@{#32452}

BUG=none
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1488563002

Cr-Commit-Position: refs/heads/master@{#32451}

R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1486003003

Cr-Commit-Position: refs/heads/master@{#32450}

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1474293002

Cr-Commit-Position: refs/heads/master@{#32449}

This greens the wasm travis build.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=asm-wasm tests
TBR=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1490673002

Cr-Commit-Position: refs/heads/master@{#32448}

This switches all remaining builtin methods to use the ES6 new.target
value when determined whether being called as a constructor or not. This
is prepatory work for fully deprecating the aforementioned intrinsic.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1474343002

Cr-Commit-Position: refs/heads/master@{#32447}

This moves the decision whether code flushing is active into the setup
phase of the GC. Components are no longer allowed to dynamically switch
the code flushing mode on demand.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1487743002

Cr-Commit-Position: refs/heads/master@{#32446}

Removes the triggered builder temporarily. In a follow up,
it'll be added with the new syntax from:
https://chromereviews.googleplex.com/319777013/

BUG=chromium:561530
LOG=n
TBR=sergiyb@chromium.org, tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1483063005

Cr-Commit-Position: refs/heads/master@{#32445}

This correctly marks functions containing a new.target reference as
being disabled with Crankshaft, which would have bailed out anyways.
Also note that this will trigger TurboFan for such functions and hence
widens the TurboFan intake valve.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1482733002

Cr-Commit-Position: refs/heads/master@{#32444}