This patch makes Promise.prototype.then use @@species as specified
in ES2015. The fix is hoped for by certain users, such as legacy
core.js versions which encounter an unhandled Promise reject (complete
with an ugly console message) when Promise subclassing is supported
in a mostly correct way, and we do error checking on Promise
constructors, but @@species is not supported.

BUG=chromium:575314,v8:4633
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1577223002

Cr-Commit-Position: refs/heads/master@{#33225}

This CL introduces ExternalStringResourceBase::IsCompressible.

This CL is a preparation for CompressibleString, which can
be compressed for memory reduction in Blink. We've found that
JavaScript strings account for a relatively large part of Blink
memory usage, and we are now trying to replace JavaScript String/
AtomicString with CompressibleString.

When a string is compressed, the original char data is deleted
and V8 pointer cache becomes invalid. This CL introduces
isCompressible  property and if an external string's isCompressble
return true, this is stored short_external_*_map instead of
external_*_map so that V8 always requires the char pointer whenever
V8 needs the string data.

BUG=chromium:574317
LOG=n

Review URL: https://codereview.chromium.org/1490193002

Cr-Commit-Position: refs/heads/master@{#33224}

This patch improves ArrayBuffer and TypedArray subclassing by adding
support for @@species and constructing outputs to certain methods
by creating an instance of the constructor determined by the
SpeciesConstructor algorithm, rather than fixed to a superclass or
naively the constructor. The new behavior is enabled by the
--harmony-species flag. Care is taken to not significantly change the
observable behavior when the flag is off. Previously, TypedArrays
already supported subclassing by reading the constructor of the
receiver, but ArrayBuffers did not, and this old behavior is
preserved and tested for, to avoid a multi-stage upgrade path and keep
things simple for users.

R=adamk
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1574903004

Cr-Commit-Position: refs/heads/master@{#33223}

Review URL: https://codereview.chromium.org/1571263004

Cr-Commit-Position: refs/heads/master@{#33222}

Enforce cases have no duplicates.
Enforce cases have a maximum range of 2^31.
Enforce default case comes last.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1578963003

Cr-Commit-Position: refs/heads/master@{#33221}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com
BUG=

Review URL: https://codereview.chromium.org/1573413002

Cr-Commit-Position: refs/heads/master@{#33220}

Besides reducing code duplication, this makes it easier to change the
implementation, which may be necessary to properly support eval calls
in arrow function parameter initializers.

Review URL: https://codereview.chromium.org/1573363002

Cr-Commit-Position: refs/heads/master@{#33219}

This patch moves the semantics of 'const' in sloppy mode to match those
in strict mode, that is, const makes lexical (let-like) bindings, must
have an initializer, and does not create properties of the global object.

R=adamk
LOG=Y
BUG=v8:3305
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1571873004

Cr-Commit-Position: refs/heads/master@{#33218}

As V8 becomes more and more spec-compliant, Promise polyfill libraries
like core.js expect fully correct. However, our Promises do not yet
support Symbol.species. Therefore, a case like

```
var test = new Promise(function(){});
test.constructor = function(){};
Promise.resolve(test)
```

would lead to an unhandled Promise rejection, whereas it should not
because test.constructor[Symbol.species] is undefined, so test.then
should end up constructing %Promise% as a fallback, rather than
calling test.constructor as if it were a constructor, which leads
this error checking code to throw.

For now, this patch removes the error checking code (which was not
present until recently). In an interactive test using core.js, the
error message on the console goes away with this patch. When @@species
support is in place, this patch can be reverted. A regression test
is added which checks for the same thing.

Partially reverted patch was originally out for review at
https://codereview.chromium.org/1531073004

BUG=v8:4633
LOG=Y
R=adamk,caitp88@gmail.com

Review URL: https://codereview.chromium.org/1578893002

Cr-Commit-Position: refs/heads/master@{#33217}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1564393003

Cr-Commit-Position: refs/heads/master@{#33216}

test-validator-asm -> test-asm-validator.

BUG=
TBR=titzer@chromium.org

Review URL: https://codereview.chromium.org/1574943004

Cr-Commit-Position: refs/heads/master@{#33215}

Does not remove the extra private state added, as doing so seems to break the
debugger.

Fixes new Test262 tests:
- built-ins/Promise/race/same-resolve-function
- built-ins/Promise/race/same-reject-function

BUG=v8:4632
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1538853002

Cr-Commit-Position: refs/heads/master@{#33214}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:575861

Review URL: https://codereview.chromium.org/1573053003

Cr-Commit-Position: refs/heads/master@{#33213}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1573143002

Cr-Commit-Position: refs/heads/master@{#33212}

Adds wide context slot load / store operations. Adds LdaContextSlotWide
and StaContextSlotWide bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1572283002

Cr-Commit-Position: refs/heads/master@{#33211}

BUG=chromium:535160
LOG=n
NOTRY=true
TBR=tandrii@chromium.org, kjellander@chromium.org

Review URL: https://codereview.chromium.org/1573913003

Cr-Commit-Position: refs/heads/master@{#33210}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1571563003

Cr-Commit-Position: refs/heads/master@{#33209}

This CL changes the color for encoding black and grey. Moreover, it introduces a higher level live object iterator.

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1517993003

Cr-Commit-Position: refs/heads/master@{#33208}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1568623004

Cr-Commit-Position: refs/heads/master@{#33207}

R=ahaas@chromium.org
LOG=Y
BUG=chromium:575369

Review URL: https://codereview.chromium.org/1577813002

Cr-Commit-Position: refs/heads/master@{#33206}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1575913002

Cr-Commit-Position: refs/heads/master@{#33205}

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1574643002

Cr-Commit-Position: refs/heads/master@{#33204}

A concurrent sweeper thread can access the same markbit cell as the main thread
during right trimming a fixed array, resulting in a data race on a markbit cell.
Previously we checked whether we were currently marking incrementally, filtering
out this case.

The current check has the benefit of keeping live_bytes accurate (modulo other
bugs) until the sweeper starts.

BUG=chromium:576193
LOG=N

Review URL: https://codereview.chromium.org/1576853002

Cr-Commit-Position: refs/heads/master@{#33203}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1578723002

Cr-Commit-Position: refs/heads/master@{#33202}

Escape analysis will eliminate the context, if possible. Materialization
must then ensure that the materialized object has the right map, and that
the context register is set accordingly.

R=jarin@chromium.org
BUG=569530,v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1572293002

Cr-Commit-Position: refs/heads/master@{#33201}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1565153002

Cr-Commit-Position: refs/heads/master@{#33200}

Until now we've been allowing unmarked asm code
through the typer. Start rejecting it.

Adding a cctest that asm modules missing an export return
fail validation.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1569423002

Cr-Commit-Position: refs/heads/master@{#33199}

In particular, Claim doesn't work with a negative size, so ensure that
it is positive.

BUG=

Review URL: https://codereview.chromium.org/1565193002

Cr-Commit-Position: refs/heads/master@{#33198}

Get the BE bots green in the short term.

BUG=

Review URL: https://codereview.chromium.org/1571243002

Cr-Commit-Position: refs/heads/master@{#33197}

  port fc5c7e04 (r33172)

  original commit message:
  There's no reason to have JavaScript wrappers for those accessors,
  since the meat is already in hand-written native code (via %_DateField).
  First step now to put them into native builtins. Next step will be to
  completely remove %_DateField.

BUG=

Review URL: https://codereview.chromium.org/1576813003

Cr-Commit-Position: refs/heads/master@{#33196}

Rolling v8/tools/clang to 0e2c562e4ee6e1a4a2f35b1bd60b2e208cd00838

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1572713003

Cr-Commit-Position: refs/heads/master@{#33195}

Removed unused name_ field, made bitfield 16-bits long, and moved it to
the start of the struct, resulting in a reduction of 8 bytes on both
32 and 64-bit platforms.

Most other changes (which prompted this work) are cosmetic:r
  - Combined redundant enums
  - Named enum values kConsistently
  - Consistently use booleans in bitfield, using enum values
    only for passing information into NewFunctionLiteral
  - Removed unneeded arguments from NewFunctionLiteral, reducing
    clutter at callsites
  - Added const correctness consistently

Review URL: https://codereview.chromium.org/1566053002

Cr-Commit-Position: refs/heads/master@{#33194}

This at least puts something in the tree demonstrating the breakage;
it can be moved into regress/ if we fix it.

R=littledan@chromium.org
BUG=v8:4577
LOG=n

Review URL: https://codereview.chromium.org/1576503002

Cr-Commit-Position: refs/heads/master@{#33193}

Originally, only BindingIdentifiers were a legal operand for the `...` ellipsis
in a function rest parameter. This has since changed, allowing the rest array
to be destructured.

The grammar is now the following:

```
FunctionRestParameter[Yield]:
    BindingRestElement[?Yield]

BindingRestElement[Yield]:
    ... BindingIdentifier[?Yield]
    ... BindingPattern[?Yield]
```

*Spec change: https://github.com/tc39/ecma262/commit/d322357e6be95bc4bd3e03f5944a736aac55fa50
*TC39 Discussion: https://github.com/tc39/tc39-notes/blob/master/es7/2015-07/july-28.md#66-bindingrestelement-should-allow-a-bindingpattern-ala-assignmentrestelement

BUG=v8:4627, v8:2159
LOG=N
R=littledan@chromium.org, adamk@chromium.org, wingo@igalia.com, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1532873004

Cr-Commit-Position: refs/heads/master@{#33192}

Port fc5c7e04

Original commit message:
There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

BUG=
TEST=test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-10, test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-11, test262/built-ins/Date/S15.9.3.1_A5_T1

Review URL: https://codereview.chromium.org/1569353002

Cr-Commit-Position: refs/heads/master@{#33191}

Encode "parenthesized" status of parenthesized Expressions to prevent
them from being treated as Patterns.

BUG=v8:4657, v8:811
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1570793002

Cr-Commit-Position: refs/heads/master@{#33190}

Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #1 id:1 of https://codereview.chromium.org/1565263002/ )

Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}

Fixed a bug in VisitForInAssignment. After visiting the object the value
to be stored was not loaded back to the accumulator. Also added two tests
to check this case.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1571753002

Cr-Commit-Position: refs/heads/master@{#33188}

Port fc5c7e04

Original commit message:
    There's no reason to have JavaScript wrappers for those accessors,
    since the meat is already in hand-written native code (via %_DateField).
    First step now to put them into native builtins. Next step will be to
    completely remove %_DateField.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1569173003

Cr-Commit-Position: refs/heads/master@{#33187}

Adds support for the CallRuntimeForPair bytecode to the Bytecode Graph
Builder. Modifies the FrameState support to allow updating of output
registers.

Also adds Eval tests to test-run-bytecode-graph-builder since these are
enabled by CallRuntimeForPair support.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1570623007

Cr-Commit-Position: refs/heads/master@{#33186}