Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset #3 id:100001 of https://codereview.chromium.org/1396333010/ )

Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}

Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}

Adds the bytecode StaGlobalStrict and replaces StaGlobal with StaGlobalSloppy.

BUG=v8:4280
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1406183002

Cr-Commit-Position: refs/heads/master@{#31339}

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1410793002

Cr-Commit-Position: refs/heads/master@{#31338}

BUG=

Review URL: https://codereview.chromium.org/1406173002

Cr-Commit-Position: refs/heads/master@{#31337}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1409113002

Cr-Commit-Position: refs/heads/master@{#31336}

Contributed by Raymond Toy: http://rtoy.github.io/fdlibm-js/

R=jkummerow@chromium.org
BUG=v8:3495
LOG=N

Review URL: https://codereview.chromium.org/1407213002

Cr-Commit-Position: refs/heads/master@{#31335}

This fixes the lifetime of nodes created by JSGlobalSpecialization that
contain a simplified operator. In the case where this reducer runs as
part of the inliner, the SimplifiedOperatorBuilder was instantiated with
the wrong zone. This led to use-after-free of simplified operators.

To avoid such situations in the future, we decided to move this operator
builder into the JSGraph and make the situation uniform with all other
operator builders.

R=bmeurer@chromium.org
BUG=chromium:543528
LOG=n

Review URL: https://codereview.chromium.org/1409993002

Cr-Commit-Position: refs/heads/master@{#31334}

To be useful for narrowing down bugs, --hydrogen-filter shouldn't prevent any
inlining that the function(s) being allowed to get optimized want(s) to do.

Free bonus content in this CL: support FLAG_stop_at in lithium-codegen-arm64,
copied from full-codegen-arm64.

Review URL: https://codereview.chromium.org/1407043004

Cr-Commit-Position: refs/heads/master@{#31333}

Revert of "[heap] Divide available memory upon compaction tasks" (patchset #2 id:20001 of https://codereview.chromium.org/1399403002/ )

Reason for revert:
Failing: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/2115

Original issue's description:
> Reland of "[heap] Divide available memory upon compaction tasks"
>
> This reverts commit ec1046f9.
>
> Original message:
>
> [heap] Divide available memory upon compaction tasks
> - Fairly (round-robin) divide available memory upon compaction tasks.
> - Ensure an upper limit (of memory) since dividing is O(n) for n free-space
>   nodes.
> - Refill from free lists managed by sweeper once a compaction space becomes
>   empty.
>
> Assumption for dividing memory: Memory in the free lists is sparse upon starting
> compaction (which means that only few nodes are available), except for memory
> reducer GCs, which happen in idle time though (so it's less of a problem).
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/a805be73f6f97645450124f75c0f7417ec7b3e70
> Cr-Commit-Position: refs/heads/master@{#31329}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1412643002

Cr-Commit-Position: refs/heads/master@{#31332}

R=cbruni@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411653002

Cr-Commit-Position: refs/heads/master@{#31331}

R=rossberg@chromium.org
BUG=v8:4471
LOG=N

Review URL: https://codereview.chromium.org/1410753002

Cr-Commit-Position: refs/heads/master@{#31330}

This reverts commit ec1046f9.

Original message:

[heap] Divide available memory upon compaction tasks
- Fairly (round-robin) divide available memory upon compaction tasks.
- Ensure an upper limit (of memory) since dividing is O(n) for n free-space
  nodes.
- Refill from free lists managed by sweeper once a compaction space becomes
  empty.

Assumption for dividing memory: Memory in the free lists is sparse upon starting
compaction (which means that only few nodes are available), except for memory
reducer GCs, which happen in idle time though (so it's less of a problem).

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1399403002

Cr-Commit-Position: refs/heads/master@{#31329}

NOTRY=true

Review URL: https://codereview.chromium.org/1413563002

Cr-Commit-Position: refs/heads/master@{#31328}

Review URL: https://codereview.chromium.org/1407883003

Cr-Commit-Position: refs/heads/master@{#31327}

The stub is used for Turbofan's fast path allocation.

Review URL: https://codereview.chromium.org/1404773002

Cr-Commit-Position: refs/heads/master@{#31326}

Revert of VectorICs: turn on vectors for STORE and KEYED_STORE ics. (patchset #1 id:1 of https://codereview.chromium.org/1396523005/ )

Reason for revert:
We harvested enough information now about the windows crash. We'll investigate that and reland when fixed.

Original issue's description:
> VectorICs: turn on vectors for STORE and KEYED_STORE ics.
>
> R=jkummerow@chromium.org
> BUG=
>
> Committed: https://crrev.com/52225f39df578e77b4804506ca4bc15e096f5cab
> Cr-Commit-Position: refs/heads/master@{#31252}
>
> Committed: https://crrev.com/31487015de401892b4d12b5faef0c47c201308da
> Cr-Commit-Position: refs/heads/master@{#31305}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1406163002

Cr-Commit-Position: refs/heads/master@{#31325}

BUG=v8:4495
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1410723002

Cr-Commit-Position: refs/heads/master@{#31324}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1408983002

Cr-Commit-Position: refs/heads/master@{#31323}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1409873002

Cr-Commit-Position: refs/heads/master@{#31322}

    port 924b0ecf (r31057).

    contributed by zhengxing.li@intel.com

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1408893002

Cr-Commit-Position: refs/heads/master@{#31321}

Rolling v8/tools/swarming_client to 3db878084b52a5e4eac0a32095e490e1b6ef9526

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1412573002

Cr-Commit-Position: refs/heads/master@{#31320}

R=titzer@google.com

Review URL: https://codereview.chromium.org/1407933002

Cr-Commit-Position: refs/heads/master@{#31319}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1403333002

Cr-Commit-Position: refs/heads/master@{#31318}

Cr-Commit-Position: refs/heads/master@{#31317}

Review URL: https://codereview.chromium.org/1397883003

Cr-Commit-Position: refs/heads/master@{#31316}

BUG=v8:4406
LOG=N

Committed: https://crrev.com/adcbe619a959fe1d8f21d06fbf5984868c4f6b9a
Cr-Commit-Position: refs/heads/master@{#31276}

Review URL: https://codereview.chromium.org/1404903004

Cr-Commit-Position: refs/heads/master@{#31315}

Also move those tests from mjsunit/harmony to mjsunit/es6.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1403633007

Cr-Commit-Position: refs/heads/master@{#31314}

Review URL: https://codereview.chromium.org/1405453003

Cr-Commit-Position: refs/heads/master@{#31313}

This change add a new bytecode for operator new and implements it using
the Construct() builtin.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/8e4f9963d53913eab7fbd2f61a5733d8dc2169e7
Cr-Commit-Position: refs/heads/master@{#31293}

Review URL: https://codereview.chromium.org/1402943002

Cr-Commit-Position: refs/heads/master@{#31312}

The CL also fixes various small bugs in context allocation.

Review URL: https://codereview.chromium.org/1404293002

Cr-Commit-Position: refs/heads/master@{#31311}

Review URL: https://codereview.chromium.org/1404283002

Cr-Commit-Position: refs/heads/master@{#31310}

Adds Scope::MaxNestedContextChainLength() which calculates the maximum length
of the context chain for the given scope. This is used by the interpreter to
preallocate the approprate number of context registers when compiling the
function.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1404793004

Cr-Commit-Position: refs/heads/master@{#31309}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1397593004

Cr-Commit-Position: refs/heads/master@{#31308}

- The bug is that we did not handle end_ properly in SearchForNodeInList.
- We now consistently account for sizes on page level in FreeList, except when
  filtering evacuation candidates (those are accounted for in FreeListCategory)

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1389293005

Cr-Commit-Position: refs/heads/master@{#31307}

In the ES2015 spec, RegExp uses ToLength, not ToInteger, on lastIndex
to coerce it to an integer. This patch switches to ToLength when
the --harmony-tolength flag is on, and adds some tests to verify the
new behavior.

BUG=v8:4244
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1394023005

Cr-Commit-Position: refs/heads/master@{#31306}

R=jkummerow@chromium.org
BUG=

Committed: https://crrev.com/52225f39df578e77b4804506ca4bc15e096f5cab
Cr-Commit-Position: refs/heads/master@{#31252}

Review URL: https://codereview.chromium.org/1396523005

Cr-Commit-Position: refs/heads/master@{#31305}

Review URL: https://codereview.chromium.org/1401703003

Cr-Commit-Position: refs/heads/master@{#31304}

R=rossberg@chromium.org
BUG=chromium:539875
LOG=y

Review URL: https://codereview.chromium.org/1393373005

Cr-Commit-Position: refs/heads/master@{#31303}

The runtime flag in question makes no sense, because the feature cannot
be disabled without keeping the snapshot in sync. We should avoid having
the flag in our "mjsunit" test suite, so that CluserFuzz doesn't pick it
up. The test in question is already skipped, the change will not affect
test results on our waterfall.

R=mvstanton@chromium.org
TEST=mjsunit/call-counts
BUG=v8:4458
LOG=n

Review URL: https://codereview.chromium.org/1409533003

Cr-Commit-Position: refs/heads/master@{#31302}