R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/955243002

Cr-Commit-Position: refs/heads/master@{#26890}

(Discovered when landing crrev.com/959693002)

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/960883003

Cr-Commit-Position: refs/heads/master@{#26889}

Reuse optimization introduced in 6dee8884.

TEST=
BUG=

Review URL: https://codereview.chromium.org/960963002

Cr-Commit-Position: refs/heads/master@{#26888}

BUG=

Review URL: https://codereview.chromium.org/961723002

Cr-Commit-Position: refs/heads/master@{#26887}

Skip the mapcheck on the global object since the global proxy and cell are already checked (or the global object map for contextual global loads).

BUG=

Review URL: https://codereview.chromium.org/961693002

Cr-Commit-Position: refs/heads/master@{#26886}

Revert of Default-enable external startup data for Linux for stand-alone builds. (patchset #1 id:1 of https://codereview.chromium.org/959693002/)

Reason for revert:
Breaks "Simple Leaks Check"

Original issue's description:
> Default-enable external startup data for Linux for stand-alone builds.
>
> Notes:
> - Other platforms to follow later.
> - This follows Chromium practice, that mostly uses this feature these days.
> - The statically linked-in startup data will stay. So whoever prefers
>   the old way just needs to set the flag differently.
>
> BUG=
>
> Committed: https://crrev.com/6d0dcaabe55ca3556bebfd771fbc7fd560fdd4e0
> Cr-Commit-Position: refs/heads/master@{#26884}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/962593003

Cr-Commit-Position: refs/heads/master@{#26885}

Notes:
- Other platforms to follow later.
- This follows Chromium practice, that mostly uses this feature these days.
- The statically linked-in startup data will stay. So whoever prefers
  the old way just needs to set the flag differently.

BUG=

Review URL: https://codereview.chromium.org/959693002

Cr-Commit-Position: refs/heads/master@{#26884}

Revert of Fix memory leak caused by field type in descriptor array. (patchset #3 id:40001 of https://codereview.chromium.org/955063002/)

Reason for revert:
Breaks test/mjsunit/debug-clearbreakpointgroup.js on arm64.debug.

Original issue's description:
> Fix memory leak caused by field type in descriptor array.
>
> When a field type is a map, it is wrapped in a weak cell upon storing to the descriptor array.
>
> Map::GetFieldType(i) does the unwrapping.
>
> BUG=v8:3877
> LOG=N
> TEST=cctest/test-heap/Regress3877
>
> Committed: https://crrev.com/77d3ae0e119893ac8d34ea6ca090cddd5bbf987e
> Cr-Commit-Position: refs/heads/master@{#26879}

TBR=verwaest@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3877

Review URL: https://codereview.chromium.org/960103003

Cr-Commit-Position: refs/heads/master@{#26883}

Revert of ensure host compiler is always clang when cross compiling from linux (patchset #6 id:100001 of https://codereview.chromium.org/955393002/)

Reason for revert:
broke some things

Original issue's description:
> ensure host compiler is always clang when cross compiling from linux
>
> BUG=
>
> Committed: https://crrev.com/56039af476797accc238dcb24c7ab926899287a0
> Cr-Commit-Position: refs/heads/master@{#26881}

TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/964483002

Cr-Commit-Position: refs/heads/master@{#26882}

BUG=

Review URL: https://codereview.chromium.org/955393002

Cr-Commit-Position: refs/heads/master@{#26881}

We cannot yet detect use-before-declaration in general, because for that we'd
need to analyze the context when compiling. But we can detect an error case
where we first see a use, then a declaration.

For this, I also added end position tracking (needed for error messages) to
VariableProxy.

Note: the position naming is completely inconsistent: start_position &
end_position, position & end_position, pos & end_pos, beg_pos & end_pos, to name
a few. This doesn't fix all of it, but tries to unify towards start_position &
end_position whenever possible w/ minimal changes.

BUG=

Review URL: https://codereview.chromium.org/943543002

Cr-Commit-Position: refs/heads/master@{#26880}

When a field type is a map, it is wrapped in a weak cell upon storing to the descriptor array.

Map::GetFieldType(i) does the unwrapping.

BUG=v8:3877
LOG=N
TEST=cctest/test-heap/Regress3877

Review URL: https://codereview.chromium.org/955063002

Cr-Commit-Position: refs/heads/master@{#26879}

BUG=
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/956283003

Cr-Commit-Position: refs/heads/master@{#26878}

BUG=chromium:403263
LOG=n

Review URL: https://codereview.chromium.org/963433002

Cr-Commit-Position: refs/heads/master@{#26877}

Revert of Temporarily disable double fields unboxing. (patchset #1 id:1 of https://codereview.chromium.org/928733003/)

Reason for revert:
Preparing to land a fix.

Original issue's description:
> Temporarily disable double fields unboxing.
>
> Committed: https://crrev.com/209cf09ac9e36c1a24cdfa918bc579a4671c6842
> Cr-Commit-Position: refs/heads/master@{#26727}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/960173002

Cr-Commit-Position: refs/heads/master@{#26876}

Only dynamically perform access checks on the receiver if it's a JSGlobalProxy. Proxies up the chain are guaranteed to provide access if we had access to the receiver, since otherwise we wouldn't have been able to compile the stub in the first place. If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=

Review URL: https://codereview.chromium.org/958843002

Cr-Commit-Position: refs/heads/master@{#26875}

BUG=

Review URL: https://codereview.chromium.org/942963004

Cr-Commit-Position: refs/heads/master@{#26874}

Side note: tools/v8-info.sh seems to have been broken ever
since the move to git.  At least it's not more broken now.

BUG=v8:3075
LOG=y

TEST=./script_test.py

Review URL: https://codereview.chromium.org/959713003

Cr-Commit-Position: refs/heads/master@{#26873}

Bad scenario:

- Enter a binop IC miss handler from optimized code object C from call
  site S,

- From the binop IC, invoke arbitrary javascript that lazy deopts C,
  so all relocation info is nuked and replaced with lazy deopt entries'
  reloc info. In particular, there is no reloc info for S.

- Still from the arbitrary JavaScript, make IC target's code object move.
  Note that the call site S is not updated.

- Return to the miss handler and inspect the IC's target. This will try
  to get the target from S, but that is a potentially invalid pointer.

It is quite possible that we will have to do a similar fix for other ICs,
but we will have to find a reliable repro first. I am not submitting a
repro here because it is quite long running and brittle (it
relies on code compaction happening while in the binop IC).

BUG=v8:3910
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/958473004

Cr-Commit-Position: refs/heads/master@{#26872}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/962523002

Cr-Commit-Position: refs/heads/master@{#26871}

Review URL: https://codereview.chromium.org/960783002

Cr-Commit-Position: refs/heads/master@{#26870}

The test did not invoke the function

BUG=v8:3921
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/961463002

Cr-Commit-Position: refs/heads/master@{#26869}

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/952343002

Cr-Commit-Position: refs/heads/master@{#26868}

Remove NativeContext from Literal array, since we always create the literals in the native context of the current closure.

BUG=

Review URL: https://codereview.chromium.org/952303002

Cr-Commit-Position: refs/heads/master@{#26867}

R=mstarzinger@chromium.org

BUG=

Review URL: https://codereview.chromium.org/948263004

Cr-Commit-Position: refs/heads/master@{#26866}

It turned out that we didn't need to treat super in a special way
in the pre parser expressions.

BUG=None
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/952283003

Cr-Commit-Position: refs/heads/master@{#26865}

We don't need this since this case is now a SyntaxError.

BUG=None
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/957823002

Cr-Commit-Position: refs/heads/master@{#26864}

The new logic ensures that the error messages are the same in the
"import { <reserved word> }" and "import { foo as <reserved ord> }"
cases.

Also prepares ParseImportNames for returning both the import and local
names to ParseImportClause.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/952863006

Cr-Commit-Position: refs/heads/master@{#26863}

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/945313003

Cr-Commit-Position: refs/heads/master@{#26862}

TEST=kraken-1.1 benchmark
BUG=

Review URL: https://codereview.chromium.org/952233002

Cr-Commit-Position: refs/heads/master@{#26861}

BUG=

Review URL: https://codereview.chromium.org/950523003

Cr-Commit-Position: refs/heads/master@{#26860}

BUG=

Review URL: https://codereview.chromium.org/951553005

Cr-Commit-Position: refs/heads/master@{#26859}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/958623002

Cr-Commit-Position: refs/heads/master@{#26858}

R=mstarzinger@chromium.org
BUG=461520
LOG=N

Review URL: https://codereview.chromium.org/955973003

Cr-Commit-Position: refs/heads/master@{#26857}

by checking instance type rather than constructor.

BUG=chromium:461734
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/953283004

Cr-Commit-Position: refs/heads/master@{#26856}

Add v8::Object::GetRealNamedPropertyAttributes() and
v8::Object::GetRealNamedPropertyAttributesInPrototypeChain().

See https://github.com/iojs/io.js/issues/864 for background.

Review URL: https://codereview.chromium.org/942003003

Cr-Commit-Position: refs/heads/master@{#26855}

R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/954693003

Cr-Commit-Position: refs/heads/master@{#26854}

In addition to Parser, other phases (such as scope analysis) need to handle
compilation errors in the future. PendingCompilationErrorHandled takes care of
error handling in a unified way.

Split from https://codereview.chromium.org/943543002/ .

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/960543002

Cr-Commit-Position: refs/heads/master@{#26853}

Xcode uses a different naming scheme for directories within
the xcodebuild directory. But it is safe to just delete
everything withing xcodebuild or out. Keep the soft clobber
for windows' build directory only, where subdirectories
follow the *release* and *debug* naming scheme.

BUG=chromium:403263
LOG=n
TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/955953002

Cr-Commit-Position: refs/heads/master@{#26852}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/944923005

Cr-Commit-Position: refs/heads/master@{#26851}