In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1425883004

Cr-Commit-Position: refs/heads/master@{#31668}

Rolling v8/buildtools to acafdaa4e81adae617177d57e3c1261cc3565469

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1420973008

Cr-Commit-Position: refs/heads/master@{#31667}

We have plans to create more ICs, and we are out of bits to represent the Kind
in the flags field of the code object. The InlineCacheState can lose a bit
because it no longer needs the DEFAULT state. That state existed as a way to
detect errors where code incorrectly looked at a vector IC stub's
InlineCacheState instead of correctly determining said state from a glance at
the vector. This really isn't a danger anymore.

So, with the horse trading, we could now represent up to 32 code kinds.

BUG=

Review URL: https://codereview.chromium.org/1427803003

Cr-Commit-Position: refs/heads/master@{#31666}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1423673003

Cr-Commit-Position: refs/heads/master@{#31665}

This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}

Most use sites of Call::GetCallType already distinguish the property
call case (i.e. formerly known as Call::PROPERTY_CALL) further. This
introduces this distinction to simplify use sites.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1414413004

Cr-Commit-Position: refs/heads/master@{#31663}

we may introduce moves that are redundant in the context of
moves on subsequent instructions. Currently, we only detect such
redundancies by allowing moves to skip over Nop instructions (true
nops, with no input/output). We can also skip over other cases, for
example over constant definitions (nop with an output), since whatever
moves happen above it do not influence the instruction's outcome.

We may be able to handle other cases, too - in subsequent CLs.

BUG=

Review URL: https://codereview.chromium.org/1422333003

Cr-Commit-Position: refs/heads/master@{#31662}

Proxies are not properly supported yet.

R=rossberg,jkummerow@chromium.org
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1421033002

Cr-Commit-Position: refs/heads/master@{#31661}

This requires copying usage flags from the outer scope to the
arrow scope upon encountering the arrow token.

In order to properly pass-on the calls_eval bit, now record
that bit on script scopes just like everywhere else, and add
necessary code to scopes.cc to handle that change in behavior.

Also factored out scope flag propagation to its own method to
make the call site simple (though note that only the eval
bit makes any difference for arrows).

BUG=v8:4395
LOG=n

Review URL: https://codereview.chromium.org/1423613002

Cr-Commit-Position: refs/heads/master@{#31660}

The fix is to broaden the set of cases for when NeedsHomeObject()
returns true. Note that this is broader than it needs to be (since,
e.g., non-arrow function scopes inside a method can't reference
super). But we don't track the types of inner scopes at the moment,
so this is the best we can do.

R=rossberg@chromium.org
BUG=v8:4522
LOG=n

Review URL: https://codereview.chromium.org/1411093008

Cr-Commit-Position: refs/heads/master@{#31659}

Also deprecate hidden values

BUG=none
LOG=y
R=rossberg@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1428793002

Cr-Commit-Position: refs/heads/master@{#31658}

Reland of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1428783004/ )

Reason for revert:
Unnecessary revert.

Original issue's description:
> Revert of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1408183006/ )
>
> Reason for revert:
> crashes on webkit_unit_tests V8-Blink Linux 32
>
> Original issue's description:
> > [heap] Decrease incremental marking finalization retry limit.
> >
> > BUG=chromium:548562
> > LOG=n
> >
> > Committed: https://crrev.com/c689f5759b46506c38c84f404ebd8dc326dcb76f
> > Cr-Commit-Position: refs/heads/master@{#31647}
>
> TBR=ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:548562
>
> Committed: https://crrev.com/f555708c5ee583dafbc803b0917c9cd87f1c9ac3
> Cr-Commit-Position: refs/heads/master@{#31648}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1412683010

Cr-Commit-Position: refs/heads/master@{#31657}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1407213005

Cr-Commit-Position: refs/heads/master@{#31656}

for starting major GC in the memory reducer.

BUG=

Review URL: https://codereview.chromium.org/1414483004

Cr-Commit-Position: refs/heads/master@{#31655}

This adapts the general purpose inlining heuristic to not inline within
or across the boundary of asm.js code. Note that this only affects the
heuristics, from a functional point of view it is still supported.

R=bmeurer@chromium.org
BUG=chromium:549000
LOG=n

Review URL: https://codereview.chromium.org/1418823005

Cr-Commit-Position: refs/heads/master@{#31654}

R=jarin@chromium.org
TEST=unittests/JSTypedLoweringTest.JSCreateArguments

Review URL: https://codereview.chromium.org/1417983004

Cr-Commit-Position: refs/heads/master@{#31653}

This refactors the handling of calls of type Call::PROPERTY_CALL to
super properties in AstGraphBuilder::VisitCall. It ensures that the
operand stack is kept in sync with full-codegen so that deopts while
evaluating sub-expressions behave as expected.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4521
BUG=v8:4521
LOG=n

Review URL: https://codereview.chromium.org/1426893003

Cr-Commit-Position: refs/heads/master@{#31652}

For..in introduces 3 new bytecodes ForInPrepare, ForInNext, and
ForInDone to start a for..in loop, get the next element, and check if
the loop is done.

For..in builds upon new LoopBuilder constructs for conditionally
breaking and continuing during iteration: BreakIf{Null|Undefined}
and ContinueIf{Null|Undefined}. New conditional jump bytecodes
support this succinctly: JumpIfNull and JumpIfUndefined.

Add missing check to BytecodeLabel that could allow multiple
forward referencess to the same label which is not supported.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1422033002

Cr-Commit-Position: refs/heads/master@{#31651}

[Interpreter] Ensure we save the BytecodeArray register properly in InterpreterEntryTrampoline builtin.

Ensure that we save the BytecodeArray register in the InterpreterEntryTrampoline
before calling out to the kStackGuard runtime function.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1426863005

Cr-Commit-Position: refs/heads/master@{#31650}

Review URL: https://codereview.chromium.org/1431443002

Cr-Commit-Position: refs/heads/master@{#31649}

Revert of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1408183006/ )

Reason for revert:
crashes on webkit_unit_tests V8-Blink Linux 32

Original issue's description:
> [heap] Decrease incremental marking finalization retry limit.
>
> BUG=chromium:548562
> LOG=n
>
> Committed: https://crrev.com/c689f5759b46506c38c84f404ebd8dc326dcb76f
> Cr-Commit-Position: refs/heads/master@{#31647}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1428783004

Cr-Commit-Position: refs/heads/master@{#31648}

BUG=chromium:548562
LOG=n

Review URL: https://codereview.chromium.org/1408183006

Cr-Commit-Position: refs/heads/master@{#31647}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1424983003

Cr-Commit-Position: refs/heads/master@{#31646}

Add support for stores that transition to writable data fields,
based on the BeginRegion/FinishRegion mechanism for atomic regions
in the scheduler.

This is early work and still a bit rough around the edges, and similar
to regular stores, we don't support transitioning stores to double
fields yet.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1406153010

Cr-Commit-Position: refs/heads/master@{#31645}

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1430643003

Cr-Commit-Position: refs/heads/master@{#31644}

R=littledan@chromium.org
BUG=v8:4305, v8:4343, v8:4344, v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1424113003

Cr-Commit-Position: refs/heads/master@{#31643}

R=littledan@chromium.org
BUG=v8:3593
LOG=n

Review URL: https://codereview.chromium.org/1407233013

Cr-Commit-Position: refs/heads/master@{#31642}

Many places in the JavaScript standard library are changed in ES2015 from
getting an integer using ToUint32 to using ToLength. This patch stages
the flag turning on those new semantics.

BUG=v8:3087,v8:4244
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1426673003

Cr-Commit-Position: refs/heads/master@{#31641}

This patch wraps callsites to %AddElement to fall back to adding a
named property in case it is given an argument of 2**32 or greater.
The change is needed because %AddElement is called by Array functions
in various places, and ES2015 changes these Array functions to use
ToLength rather than ToUint32, so several callsites of %AddElement
which used to be reliable array indices may be larger numbers. While
the proper long-term solution may be to call out to
Object.defineProperty, this fix should allow the ToLength semantics
to be shipped while preserving correctness and not requiring a
rewrite.

BUG=v8:4516
LOG=Y
R=adamk
TEST=Interactively ran Array.prototype.slice on an Array-like which
exceeded array bounds, and found that this did not check-fail at
runtime as it did before.
Microbenchmarked this technique against the previous version on a
simple reverse implementation and found at most a 1% slowdown, as
opposed to other techniques, like calling %DefineDataPropertyUnchecked,
which had a 20% slowdown or Object.defineProperty with a 80% slowdown.

Review URL: https://codereview.chromium.org/1420663003

Cr-Commit-Position: refs/heads/master@{#31640}

Review URL: https://codereview.chromium.org/1424233002

Cr-Commit-Position: refs/heads/master@{#31639}

TEST=cctest/test-run-machops/RunUint32MulHighP,RunUint32DivP
BUG=

Review URL: https://codereview.chromium.org/1425003003

Cr-Commit-Position: refs/heads/master@{#31638}

Now that we have a C++ implementation, calling into JS builtins is needlessly inefficient.

Review URL: https://codereview.chromium.org/1410553006

Cr-Commit-Position: refs/heads/master@{#31637}

It was shipped in M46 without incident.

Review URL: https://codereview.chromium.org/1411723007

Cr-Commit-Position: refs/heads/master@{#31636}

These features shipped in M46 without issue.

Review URL: https://codereview.chromium.org/1429653006

Cr-Commit-Position: refs/heads/master@{#31635}

R=bmeurer@chromium.org,hablich@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1416873007

Cr-Commit-Position: refs/heads/master@{#31634}

For platforms that use function descriptors (currently AIX and
PPC64BE), log an external callback's entrypoint address rather than
its function descriptor address.  This allows proper lookup in the
tick processor's symbol table.

R=jkummerow@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1409993006

Cr-Commit-Position: refs/heads/master@{#31633}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1417163004

Cr-Commit-Position: refs/heads/master@{#31632}

Rename ZoneTypeCache to TypeCache and use a single shared (immutable)
instance consistently to cache the most commonly used types. Also serves
as a chokepoint for defining those types, so we don't repeat the
definition (and possible bugs) in various places.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1409763004

Cr-Commit-Position: refs/heads/master@{#31631}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1408283006

Cr-Commit-Position: refs/heads/master@{#31630}

TEST=cctest/test-gap-resolver/FuzzResolver,unittests/MoveOptimizerTest.RemovesRedundantExplicit
BUG=

Review URL: https://codereview.chromium.org/1403373016

Cr-Commit-Position: refs/heads/master@{#31629}