Because that's what it actually does

R=verwaest@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1410073005

Cr-Commit-Position: refs/heads/master@{#31563}

BUG=

Review URL: https://codereview.chromium.org/1420933004

Cr-Commit-Position: refs/heads/master@{#31562}

Review URL: https://codereview.chromium.org/1414223004

Cr-Commit-Position: refs/heads/master@{#31561}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1420413002

Cr-Commit-Position: refs/heads/master@{#31560}

Revert of Ignore test failure for mjsunit/for-in-opt in gc stress. (patchset #1 id:1 of https://codereview.chromium.org/1295513004/ )

Reason for revert:
This test should work.

Original issue's description:
> Ignore test failure for mjsunit/for-in-opt in gc stress.
>
> TBR=hablich@chromium.org
> BUG=v8:4381
>
> Committed: https://crrev.com/22cf0b591968b7b305094d386d6b10e6c0e723cc
> Cr-Commit-Position: refs/heads/master@{#30245}

TBR=hablich@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4381
LOG=n

Review URL: https://codereview.chromium.org/1419823009

Cr-Commit-Position: refs/heads/master@{#31559}

This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410393006

Cr-Commit-Position: refs/heads/master@{#31558}

LOG=N
BUG=chromium:545503

Review URL: https://codereview.chromium.org/1409073005

Cr-Commit-Position: refs/heads/master@{#31557}

BUG=v8:4460
LOG=n

Review URL: https://codereview.chromium.org/1419823008

Cr-Commit-Position: refs/heads/master@{#31556}

The data field is passed to the failed access check callback which blink
depends on.

BUG=none
R=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1427443002

Cr-Commit-Position: refs/heads/master@{#31555}

the memory reducer is enabled.

BUG=

Review URL: https://codereview.chromium.org/1419393002

Cr-Commit-Position: refs/heads/master@{#31554}

Currently we (mostly) infer FunctionType for JSFunction constants, and
match the FunctionType in the typing rule for JSCallFunction. This has
several drawbacks for JavaScript, especially we don't have Constant
types for global functions (i.e. String, Object, Reflect and friends).
Plus the FunctionType magic doesn't actually buy us anything. So this
changes the typing rule for HeapConstant constant to actually infer
Constant types for JSFunction objects and moves the recognition of
builtin functions to the typing rule for JSCallFunction.

Also adapts the specialized lowering in JSTypedLowering to Constant
functions instead of FunctionType, which has the additional advantage
that we can do the receiver wrapping/converting based on the (known)
SharedFunctionInfo.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420093005

Cr-Commit-Position: refs/heads/master@{#31553}

      The reason is when native_context_specialization flag is ture, X87 turbofan
      will hit the known issue that X87 will change a sNaN to qNaN by default. And
      then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

   reland https://codereview.chromium.org/1414733004/.

BUG=

Review URL: https://codereview.chromium.org/1419573007

Cr-Commit-Position: refs/heads/master@{#31552}

Cr-Commit-Position: refs/heads/master@{#31551}

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1412113004

Cr-Commit-Position: refs/heads/master@{#31550}

LOG=N
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1420833004

Cr-Commit-Position: refs/heads/master@{#31549}

BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1419583007

Cr-Commit-Position: refs/heads/master@{#31548}

Review URL: https://codereview.chromium.org/1411093006

Cr-Commit-Position: refs/heads/master@{#31547}

This patch simply fixes few typos which should have been features
and closure.

BUG=
NOTRY=true
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1413023003

Cr-Commit-Position: refs/heads/master@{#31546}

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1402383005

Cr-Commit-Position: refs/heads/master@{#31545}

This addresses an issue where the at-start splitting used
in the splintering mechanism was in conflict with the mechanics
used in linear allocator, in particular in the initial split/spill of
ranges for memory operands. We are already doing a split-at-start in
Greedy, so this change centralizes that to the base RegisterAllocator.

Verified locally that v8:4508 is addressed by this. Also, this fixes
the failures that required the revert
5308a999. See trybots at
issue 1425533002.

R=bmeurer@chromium.org,jarin@chromium.org
BUG= v8:4508
LOG=n

Review URL: https://codereview.chromium.org/1426583002

Cr-Commit-Position: refs/heads/master@{#31544}

Revert of X87: disable the regress-undefined-nan test case for x87. (patchset #1 id:1 of https://codereview.chromium.org/1414733004/ )

Reason for revert:
because of merge mistake, "regress/" is missed when skipping one test case for X87.

 "regress/" will be added when relanding it.

Original issue's description:
> X87: disable the regress-undefined-nan test case for x87.
>
>   The reason is when native_context_specialization flag is ture, X87 turbofan
>   will hit the known issue that X87 will change a sNaN to qNaN by default. And
>   then it will fail when bit-comparing the source (sNaN) and the result (qNaN).
>
> BUG=
>
> Committed: https://crrev.com/b3c719ebbad6c87afefa33a7d0b3f412b2e304db
> Cr-Commit-Position: refs/heads/master@{#31530}

TBR=bmeurer@chromium.org,weiliang.lin@intel.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1417303005

Cr-Commit-Position: refs/heads/master@{#31543}

    port e678a0f9 (r31358)

    original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

BUG=

Review URL: https://codereview.chromium.org/1421803002

Cr-Commit-Position: refs/heads/master@{#31542}

    port 053e280c (r31319).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1420233002

Cr-Commit-Position: refs/heads/master@{#31541}

Cr-Commit-Position: refs/heads/master@{#31540}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413903003

Cr-Commit-Position: refs/heads/master@{#31539}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413013003

Cr-Commit-Position: refs/heads/master@{#31538}

For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}

Rolling v8/tools/clang to 66f5328417331216569e8beb244fd887f62e8997

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1403423006

Cr-Commit-Position: refs/heads/master@{#31536}

Revert of Reland "Use C++ implementation of Object.definePropert{y,ies}" (patchset #2 id:20001 of https://codereview.chromium.org/1413123004/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> Reland "Use C++ implementation of Object.definePropert{y,ies}"
>
> This reverts commit 581ead5c.
>
> Committed: https://crrev.com/034f4a6ae14cd5c29ceddbdb8f9af179803ca793
> Cr-Commit-Position: refs/heads/master@{#31473}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421123002

Cr-Commit-Position: refs/heads/master@{#31535}

Revert of Introduce LookupIterator::Restart() and use it (patchset #2 id:20001 of https://codereview.chromium.org/1416053007/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Needed so the reverts applies cleanly and seems to be related to the offending CL.

Original issue's description:
> Introduce LookupIterator::Restart() and use it
>
> Committed: https://crrev.com/5676415b4add059b78f98a9a762d00c8d721dbcd
> Cr-Commit-Position: refs/heads/master@{#31483}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418213003

Cr-Commit-Position: refs/heads/master@{#31534}

Revert of OrdinaryDefineOwnProperty: always reset the LookupIterator before storing. (patchset #1 id:1 of https://codereview.chromium.org/1415823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> OrdinaryDefineOwnProperty: always reset the LookupIterator before storing.
>
> Committed: https://crrev.com/7bc5ce16ee9244869384cdf17ea2feb0a9dde9bd
> Cr-Commit-Position: refs/heads/master@{#31511}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418303002

Cr-Commit-Position: refs/heads/master@{#31533}

Revert of GetOwnPropertyDescriptor: API-style accessors can throw, check for that. (patchset #1 id:1 of https://codereview.chromium.org/1412823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> GetOwnPropertyDescriptor: API-style accessors can throw, check for that.
>
> Committed: https://crrev.com/cbda86196b0b52694f50982ae3f1ac8e72056e6d
> Cr-Commit-Position: refs/heads/master@{#31522}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421483004

Cr-Commit-Position: refs/heads/master@{#31532}

Revert of [Turbofan] Fix perf regression (patchset #1 id:1 of https://codereview.chromium.org/1412123009/ )

Reason for revert:
[sheriff] breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/4998

Original issue's description:
> [Turbofan] Fix perf regression introduced by per-range change.
>
> When the range ends just at the gap of a non-deferred block, the last
> instruction the range covers is in the predecessor. If that predecessor is
> a deferred block, before this CL, we would splinter the remainder of the
> range all the way to the end. That leads to inefficient codegen, because
> we still want a split inside the deferred block.
>
> Also, opportunistically added a trace before we splinter, for better
> diagnostics.
>
> BUG= chromium:546416
> LOG=N
>
> Committed: https://crrev.com/32b6e085e74a8fcf94a01d20740fe4fdede07a86
> Cr-Commit-Position: refs/heads/master@{#31529}

TBR=bmeurer@chromium.org,jarin@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= chromium:546416

Review URL: https://codereview.chromium.org/1412893007

Cr-Commit-Position: refs/heads/master@{#31531}

  The reason is when native_context_specialization flag is ture, X87 turbofan
  will hit the known issue that X87 will change a sNaN to qNaN by default. And
  then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

BUG=

Review URL: https://codereview.chromium.org/1414733004

Cr-Commit-Position: refs/heads/master@{#31530}

When the range ends just at the gap of a non-deferred block, the last
instruction the range covers is in the predecessor. If that predecessor is
a deferred block, before this CL, we would splinter the remainder of the
range all the way to the end. That leads to inefficient codegen, because
we still want a split inside the deferred block.

Also, opportunistically added a trace before we splinter, for better
diagnostics.

BUG= chromium:546416
LOG=N

Review URL: https://codereview.chromium.org/1412123009

Cr-Commit-Position: refs/heads/master@{#31529}

Review URL: https://codereview.chromium.org/1413663007

Cr-Commit-Position: refs/heads/master@{#31528}

Setting the prototype to whatever it currently is must succeed even if
the object is not extensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1423603002

Cr-Commit-Position: refs/heads/master@{#31527}

Fix aborting compaction for pages by doing two separate passes, one that scans
all live objects, and one that later on sweeps the page.

Detailed description see bug report.

BUG=chromium:539356,chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1413763011

Cr-Commit-Position: refs/heads/master@{#31526}

This patch switches sloppy-mode code from legacy const semantics
to ES2015 semantics. It is unknown how much of the web will be
broken by this; likely the patch will have to be reverted before
a branch happens.

BUG=v8:3739
LOG=Y
R=rossberg,adamk

Review URL: https://codereview.chromium.org/1420223003

Cr-Commit-Position: refs/heads/master@{#31525}

We don't need to have an (untested) fallback for the case that a
prototype map is not stable when specializing a named property,
because prototype maps are always stable (which is now guarded
by a DCHECK in CompilationDependencies).  Less (dead) code is
better code.

R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417973006

Cr-Commit-Position: refs/heads/master@{#31524}