Instead, views have to check their array buffer for whether
it's neutered or not.

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1094863002

Cr-Commit-Position: refs/heads/master@{#27995}

BUG=

Review URL: https://codereview.chromium.org/1104463002

Cr-Commit-Position: refs/heads/master@{#27994}

Not just emptiness, but also a particular structure.

BUG=v8:4044
LOG=N

Review URL: https://codereview.chromium.org/1092043002

Cr-Commit-Position: refs/heads/master@{#27993}

TBR=svenpanne@chromium.org, titzer@chromium.org, bmeurer@chromium.org,
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1101653002

Cr-Commit-Position: refs/heads/master@{#27992}

Revert of [strong] checking of this & super in constructors (patchset #7 id:110001 of https://codereview.chromium.org/1024063002/)

Reason for revert:
[Sheriff] Breaks mac gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1024

Original issue's description:
> [strong] checking of this & super in constructors
>
> R=dslomov@chromium.org, marja@chromium.org
> BUG=v8:3956
> LOG=N
>
> Enforces for constructors that
> - the only use of 'super' is the super constructor call
> - the only use of 'this' is a property assignment
> - both of these must happen at the top-level of the body
> - 'this' may only be assigned after the 'super' call
> - 'return' may only be used after the last assignment to 'this'
>
> Not yet working for arrow functions (there might be deeper bugs with those).
>
> Committed: https://crrev.com/580d66bcda66220d2f3062ac58daf925436df74c
> Cr-Commit-Position: refs/heads/master@{#27977}

TBR=dslomov@chromium.org,marja@chromium.org,conradw@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1105453002

Cr-Commit-Position: refs/heads/master@{#27991}

Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #7 id:140001 of https://codereview.chromium.org/1011823003/)

Reason for revert:
[Sheriff] breaks mac gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1029

Original issue's description:
> [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions)
>
> BUG=v8:3965, v8:3966
> R=arv@chromium.org
> LOG=N
>
> Committed: https://crrev.com/b09c048f693d280052ac63c7d6b3baf27b3bf271
> Cr-Commit-Position: refs/heads/master@{#27985}

TBR=arv@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3965, v8:3966

Review URL: https://codereview.chromium.org/1103473003

Cr-Commit-Position: refs/heads/master@{#27990}

Also adjust the test runner to remove --always-opt for FAST_VARIANTS.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1056423004

Cr-Commit-Position: refs/heads/master@{#27989}

R=ulan@chromium.org
BUG=v8:4050
LOG=N

Review URL: https://codereview.chromium.org/1099103003

Cr-Commit-Position: refs/heads/master@{#27988}

This reverts commit bb346227 because it
adds a lot of overhead without significantly increasing our test
coverage. We need a different approach to deal with this.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1099813007

Cr-Commit-Position: refs/heads/master@{#27987}

Rolling v8/tools/clang to 442f528de2269272de9610e9c7186047ce4aaadb

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1065783004

Cr-Commit-Position: refs/heads/master@{#27986}

BUG=v8:3965, v8:3966
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1011823003

Cr-Commit-Position: refs/heads/master@{#27985}

Revert of [es6] implement Array.prototype.copyWithin() (patchset #7 id:120001 of https://codereview.chromium.org/376623004/)

Reason for revert:
[Sheriff] This causes test failures on mac gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1027

Original issue's description:
> [es6] implement Array.prototype.copyWithin()
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.copywithin
>
> BUG=v8:4039
> R=adamk@chromium.org
> LOG=N

TBR=dslomov@chromium.org,rossberg@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4039

Review URL: https://codereview.chromium.org/1084183004

Cr-Commit-Position: refs/heads/master@{#27984}

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.copywithin

BUG=v8:4039
R=adamk@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/376623004

Cr-Commit-Position: refs/heads/master@{#27983}

Revert of track global accesses to constant types (patchset #15 id:280001 of https://codereview.chromium.org/1062163005/)

Reason for revert:
[Sheriff] Speculative revert for maybe breaking layout tests, e.g.
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2032/builds/2589

Will reland if it doesn't help.

Original issue's description:
> track global accesses to constant types
>
> BUG=

TBR=verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1094313003

Cr-Commit-Position: refs/heads/master@{#27982}

Revert of fix bad rebase in r27966 (patchset #1 id:1 of https://codereview.chromium.org/1083923005/)

Reason for revert:
Needed to revert https://chromium.googlesource.com/v8/v8/+/7bcc3d10835105fadc8ecf42a877dec479f0f80d

Original issue's description:
> fix bad rebase in r27966
>
> TBR=verwaest@chromium.org
>
> BUG=

TBR=verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1093043003

Cr-Commit-Position: refs/heads/master@{#27981}

BUG=v8:3018
R=dslomov@chromium.org, arv@chromium.org, rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1096363002

Cr-Commit-Position: refs/heads/master@{#27980}

Note: can't be landed until LoadProperty => LoadNamed is fixed.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1101473004

Cr-Commit-Position: refs/heads/master@{#27979}

BUG=v8:2159
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1099813005

Cr-Commit-Position: refs/heads/master@{#27978}

R=dslomov@chromium.org, marja@chromium.org
BUG=v8:3956
LOG=N

Enforces for constructors that
- the only use of 'super' is the super constructor call
- the only use of 'this' is a property assignment
- both of these must happen at the top-level of the body
- 'this' may only be assigned after the 'super' call
- 'return' may only be used after the last assignment to 'this'

Not yet working for arrow functions (there might be deeper bugs with those).

Review URL: https://codereview.chromium.org/1024063002

Cr-Commit-Position: refs/heads/master@{#27977}

This was a TODO for a while in crankshaft, now ready to address.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1093413002

Cr-Commit-Position: refs/heads/master@{#27976}

Revert of Reland "LayoutDescriptor should inherit from JSTypedArray" (patchset #3 id:40001 of https://codereview.chromium.org/1094333002/)

Reason for revert:
Breaks gbemu

Original issue's description:
> Reland "LayoutDescriptor should inherit from JSTypedArray"
>
> Original issue's description:
> > LayoutDescriptor should inherit from JSTypedArray
> >
> > It can't just inherit from a FixedTypedArray-like type, as we soon
> > assume that a FixedTypedArray-like type is always held by an
> > ArrayBufferView-like type
> >
> > BUG=v8:3996
> > R=ishell@chromium.org,verwaest@chromium.org
> > LOG=n
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

TBR=ishell@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1080403004

Cr-Commit-Position: refs/heads/master@{#27975}

This allows the JSIntrinsicLowering to optimize the cloning of literal
boilerplate objects using either the FastCloneShallowArrayStub or the
FastCloneShallowObjectStub when applicable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1097963002

Cr-Commit-Position: refs/heads/master@{#27974}

Original issue's description:
> LayoutDescriptor should inherit from JSTypedArray
>
> It can't just inherit from a FixedTypedArray-like type, as we soon
> assume that a FixedTypedArray-like type is always held by an
> ArrayBufferView-like type
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=ishell@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1094333002

Cr-Commit-Position: refs/heads/master@{#27973}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095313002

Cr-Commit-Position: refs/heads/master@{#27972}

Originally landed in https://codereview.chromium.org/1061983004;
re-landing after re-landing formal parameter parsing refactors.

R=marja@chromium.org
BUG=v8:4020
LOG=N

Review URL: https://codereview.chromium.org/1077153005

Cr-Commit-Position: refs/heads/master@{#27971}

TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1083923005

Cr-Commit-Position: refs/heads/master@{#27970}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1054763003

Cr-Commit-Position: refs/heads/master@{#27969}

Revert of LayoutDescriptor should inherit from JSTypedArray (patchset #1 id:1 of https://codereview.chromium.org/1084793004/)

Reason for revert:
breaks mjsunit on debug bots

Original issue's description:
> LayoutDescriptor should inherit from JSTypedArray
>
> It can't just inherit from a FixedTypedArray-like type, as we soon
> assume that a FixedTypedArray-like type is always held by an
> ArrayBufferView-like type
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

TBR=ishell@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1073053006

Cr-Commit-Position: refs/heads/master@{#27968}

R=dusan.milosavljevic@imgtec.com

Review URL: https://codereview.chromium.org/1101503003

Cr-Commit-Position: refs/heads/master@{#27967}

BUG=

Review URL: https://codereview.chromium.org/1062163005

Cr-Commit-Position: refs/heads/master@{#27966}

Review URL: https://codereview.chromium.org/1097313002

Cr-Commit-Position: refs/heads/master@{#27965}

It can't just inherit from a FixedTypedArray-like type, as we soon
assume that a FixedTypedArray-like type is always held by an
ArrayBufferView-like type

BUG=v8:3996
R=ishell@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1084793004

Cr-Commit-Position: refs/heads/master@{#27964}

this is in preparation for landing the GreedyAllocator

BUG=

Review URL: https://codereview.chromium.org/1100713003

Cr-Commit-Position: refs/heads/master@{#27963}

These tests are based on individual tests from the Emscripten benchmark
suite, which are used to test Emscripten itself. We adopt them to test
asm.js code paths in V8.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1101493002

Cr-Commit-Position: refs/heads/master@{#27962}

Plus some driveby cleanup.

Review URL: https://codereview.chromium.org/1099093002

Cr-Commit-Position: refs/heads/master@{#27961}

This commit is a precursor to making lazy arrow function parsing use
similar logic to function(){} argument parsing.

Originally landed in these three CLs:

  https://codereview.chromium.org/1078093002
  https://codereview.chromium.org/1083623002
  https://codereview.chromium.org/1083953002

These were rolled out due to a performance regression on CodeLoad.  This
patchset will fix that by avoiding creation of a DuplicateFinder in the
full parser.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1100713002

Cr-Commit-Position: refs/heads/master@{#27960}

Also extract non-templated parts of HashTable class into HashTableBase.

Review URL: https://codereview.chromium.org/1095273002

Cr-Commit-Position: refs/heads/master@{#27959}

Baby steps towards saner #includes...

Review URL: https://codereview.chromium.org/1051393003

Cr-Commit-Position: refs/heads/master@{#27958}

BUG=none
R=danno@chromium.org
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1098873002

Cr-Commit-Position: refs/heads/master@{#27957}

If a scavenge is triggered during the GC (via a weak callback or the GC
prologue/epilogue), and another mark-compact is triggered (via the same
unfortunate code path), we end up doing some incremental steps.

BUG=v8:4048
R=dcarney@chromium.org,hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1096693011

Cr-Commit-Position: refs/heads/master@{#27956}