R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1575913002

Cr-Commit-Position: refs/heads/master@{#33205}

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1574643002

Cr-Commit-Position: refs/heads/master@{#33204}

A concurrent sweeper thread can access the same markbit cell as the main thread
during right trimming a fixed array, resulting in a data race on a markbit cell.
Previously we checked whether we were currently marking incrementally, filtering
out this case.

The current check has the benefit of keeping live_bytes accurate (modulo other
bugs) until the sweeper starts.

BUG=chromium:576193
LOG=N

Review URL: https://codereview.chromium.org/1576853002

Cr-Commit-Position: refs/heads/master@{#33203}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1578723002

Cr-Commit-Position: refs/heads/master@{#33202}

Escape analysis will eliminate the context, if possible. Materialization
must then ensure that the materialized object has the right map, and that
the context register is set accordingly.

R=jarin@chromium.org
BUG=569530,v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1572293002

Cr-Commit-Position: refs/heads/master@{#33201}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1565153002

Cr-Commit-Position: refs/heads/master@{#33200}

Until now we've been allowing unmarked asm code
through the typer. Start rejecting it.

Adding a cctest that asm modules missing an export return
fail validation.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1569423002

Cr-Commit-Position: refs/heads/master@{#33199}

In particular, Claim doesn't work with a negative size, so ensure that
it is positive.

BUG=

Review URL: https://codereview.chromium.org/1565193002

Cr-Commit-Position: refs/heads/master@{#33198}

Get the BE bots green in the short term.

BUG=

Review URL: https://codereview.chromium.org/1571243002

Cr-Commit-Position: refs/heads/master@{#33197}

  port fc5c7e04 (r33172)

  original commit message:
  There's no reason to have JavaScript wrappers for those accessors,
  since the meat is already in hand-written native code (via %_DateField).
  First step now to put them into native builtins. Next step will be to
  completely remove %_DateField.

BUG=

Review URL: https://codereview.chromium.org/1576813003

Cr-Commit-Position: refs/heads/master@{#33196}

Rolling v8/tools/clang to 0e2c562e4ee6e1a4a2f35b1bd60b2e208cd00838

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1572713003

Cr-Commit-Position: refs/heads/master@{#33195}

Removed unused name_ field, made bitfield 16-bits long, and moved it to
the start of the struct, resulting in a reduction of 8 bytes on both
32 and 64-bit platforms.

Most other changes (which prompted this work) are cosmetic:r
  - Combined redundant enums
  - Named enum values kConsistently
  - Consistently use booleans in bitfield, using enum values
    only for passing information into NewFunctionLiteral
  - Removed unneeded arguments from NewFunctionLiteral, reducing
    clutter at callsites
  - Added const correctness consistently

Review URL: https://codereview.chromium.org/1566053002

Cr-Commit-Position: refs/heads/master@{#33194}

This at least puts something in the tree demonstrating the breakage;
it can be moved into regress/ if we fix it.

R=littledan@chromium.org
BUG=v8:4577
LOG=n

Review URL: https://codereview.chromium.org/1576503002

Cr-Commit-Position: refs/heads/master@{#33193}

Originally, only BindingIdentifiers were a legal operand for the `...` ellipsis
in a function rest parameter. This has since changed, allowing the rest array
to be destructured.

The grammar is now the following:

```
FunctionRestParameter[Yield]:
    BindingRestElement[?Yield]

BindingRestElement[Yield]:
    ... BindingIdentifier[?Yield]
    ... BindingPattern[?Yield]
```

*Spec change: https://github.com/tc39/ecma262/commit/d322357e6be95bc4bd3e03f5944a736aac55fa50
*TC39 Discussion: https://github.com/tc39/tc39-notes/blob/master/es7/2015-07/july-28.md#66-bindingrestelement-should-allow-a-bindingpattern-ala-assignmentrestelement

BUG=v8:4627, v8:2159
LOG=N
R=littledan@chromium.org, adamk@chromium.org, wingo@igalia.com, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1532873004

Cr-Commit-Position: refs/heads/master@{#33192}

Port fc5c7e04

Original commit message:
There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

BUG=
TEST=test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-10, test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-11, test262/built-ins/Date/S15.9.3.1_A5_T1

Review URL: https://codereview.chromium.org/1569353002

Cr-Commit-Position: refs/heads/master@{#33191}

Encode "parenthesized" status of parenthesized Expressions to prevent
them from being treated as Patterns.

BUG=v8:4657, v8:811
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1570793002

Cr-Commit-Position: refs/heads/master@{#33190}

Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #1 id:1 of https://codereview.chromium.org/1565263002/ )

Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}

Fixed a bug in VisitForInAssignment. After visiting the object the value
to be stored was not loaded back to the accumulator. Also added two tests
to check this case.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1571753002

Cr-Commit-Position: refs/heads/master@{#33188}

Port fc5c7e04

Original commit message:
    There's no reason to have JavaScript wrappers for those accessors,
    since the meat is already in hand-written native code (via %_DateField).
    First step now to put them into native builtins. Next step will be to
    completely remove %_DateField.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1569173003

Cr-Commit-Position: refs/heads/master@{#33187}

Adds support for the CallRuntimeForPair bytecode to the Bytecode Graph
Builder. Modifies the FrameState support to allow updating of output
registers.

Also adds Eval tests to test-run-bytecode-graph-builder since these are
enabled by CallRuntimeForPair support.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1570623007

Cr-Commit-Position: refs/heads/master@{#33186}

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816

Review URL: https://codereview.chromium.org/1564923007

Cr-Commit-Position: refs/heads/master@{#33185}

Adds support for calling eval to the interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1508293003

Cr-Commit-Position: refs/heads/master@{#33184}

This patch introduces a mechanism for changing the scope of temporary
variables, which is necessary for rewriting arrow parameter
initializers.

It also fixes a potential bug in AstExpressionVisitor, which did not
visit the automatically generated members of ForEachStatement.

Fixes test/mjsunit/harmony/regress/regress-4658.js

R=rossberg@chromium.org
BUG=v8:4658
LOG=N

Review URL: https://codereview.chromium.org/1564343002

Cr-Commit-Position: refs/heads/master@{#33183}

Matches https://crrev.com/366832

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1551453002

Cr-Commit-Position: refs/heads/master@{#33182}

Adds support for calling runtime functions which return a pair of
values. Adds the bytecode CallRuntimePair. Also adds support to TurboFan
for calling stubs which return multiple values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568493002

Cr-Commit-Position: refs/heads/master@{#33181}

R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1543553002

Cr-Commit-Position: refs/heads/master@{#33180}

BUG=chromium:574953
LOG=n

Review URL: https://codereview.chromium.org/1570443004

Cr-Commit-Position: refs/heads/master@{#33179}

It's sufficient to check for --harmony-unicode-regexps when parsing the
regexp flags from string.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1567413002

Cr-Commit-Position: refs/heads/master@{#33178}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1567393003

Cr-Commit-Position: refs/heads/master@{#33177}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1568293002

Cr-Commit-Position: refs/heads/master@{#33176}

R=mstarzinger@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575364

Review URL: https://codereview.chromium.org/1564313003

Cr-Commit-Position: refs/heads/master@{#33175}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1569223002

Cr-Commit-Position: refs/heads/master@{#33174}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571713002

Cr-Commit-Position: refs/heads/master@{#33173}

There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567353002

Cr-Commit-Position: refs/heads/master@{#33172}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571703002

Cr-Commit-Position: refs/heads/master@{#33171}

* Buffer counter updates in the corresponding visitor to allow parallel
  processing of pages.
* Fix a bug where we don't keep live bytes in sync when marking is already
  finished.

LOG=N
BUG=524425

Review URL: https://codereview.chromium.org/1559873004

Cr-Commit-Position: refs/heads/master@{#33170}

R=rossberg@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1565183002

Cr-Commit-Position: refs/heads/master@{#33169}

LOG=N
BUG=v8:4606
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1572513002

Cr-Commit-Position: refs/heads/master@{#33168}

Everything necessary to implement Object.keys efficiently is already
available in C++ land for quite some time now, and only the thin
JavaScript wrapper was left, so get rid of that as well and move the
whole builtin to C++ instead.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567963002

Cr-Commit-Position: refs/heads/master@{#33167}

  The original kX87BitcastFI and kX87BitcastIF of x87 code generation in TurboFan have bugs and caused all Run_Wasm_F32CopySign test cases failed.

  This CL will fix them.

BUG=

Review URL: https://codereview.chromium.org/1565183003

Cr-Commit-Position: refs/heads/master@{#33166}