The enumerable expression in a for-in/of loop is supposed to have a TDZ for any
lexically bound names in that loop (there can be more than one with destructuring).

This patch accomplishes this with an almost-correct desugaring. The only thing missing
is proper debugger support (the let declarations added by the desugaring, while invisible
to code due to shadowing, are visible to the debugger).

BUG=v8:4210
LOG=n

Review URL: https://codereview.chromium.org/1218543003

Cr-Commit-Position: refs/heads/master@{#29396}

The asm.js spec decides the type of numeric literals in several places
based on if they contain a ".".
http://asmjs.org/spec/latest/

Adding methods so that AST Literals can be checked for containg a dot.

Adding a cctest that this information is available.

LOG=N
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-parsing
R=rossberg@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/1201783003

Cr-Commit-Position: refs/heads/master@{#29395}

BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1216023003

Cr-Commit-Position: refs/heads/master@{#29394}

Revert of [test262-es6] Update to 2011-06-29 (patchset #1 id:1 of https://codereview.chromium.org/1220793005/)

Reason for revert:
[Sheriff] Runner has some infra failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/4020/steps/Test262-es6%20-%20no%20variants/logs/stdio

Original issue's description:
> [test262-es6] Update to 2011-06-29
>
> This includes one harness fix but introduces a few new failures. No
> new bugs exposed though.
>
> BUG=N
> LOG=N
> R=littledan@chromium.org, adamk@chromium.org
>
> Committed: https://crrev.com/2e877628803f238dd33c3409413cd7778e36a2b6
> Cr-Commit-Position: refs/heads/master@{#29392}

TBR=littledan@chromium.org,adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1212163008

Cr-Commit-Position: refs/heads/master@{#29393}

This includes one harness fix but introduces a few new failures. No
new bugs exposed though.

BUG=N
LOG=N
R=littledan@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1220793005

Cr-Commit-Position: refs/heads/master@{#29392}

This resolves the mirror-object test failure.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1214903009

Cr-Commit-Position: refs/heads/master@{#29391}

Revert of [strong] Add tests for loading from proxy, super, with access checks (patchset #4 id:80001 of https://codereview.chromium.org/1193633003/)

Reason for revert:
[Sheriff] Breaks gc stress:
http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%202/builds/3968

Original issue's description:
> [strong] Add tests for loading from proxy, super, with access checks
>
> Followup for https://codereview.chromium.org/1168093002/
>
> These seem to already function correctly without the need for further runtime
> changes.
>
> There will be a final follow-up for interceptors.
>
> BUG=v8:3956
> LOG=N
>
> Committed: https://crrev.com/ea4e568363f48955e7de6b538e559132e9899c86
> Cr-Commit-Position: refs/heads/master@{#29389}

TBR=rossberg@chromium.org,conradw@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1218123003

Cr-Commit-Position: refs/heads/master@{#29390}

Followup for https://codereview.chromium.org/1168093002/

These seem to already function correctly without the need for further runtime
changes.

There will be a final follow-up for interceptors.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1193633003

Cr-Commit-Position: refs/heads/master@{#29389}

v8::Internal::List will DCHECK when indexing out of the array, even if just to
get the address, and the value is never used. So this construct will fail:

    memcpy(p, &data[0], length);

When data is empty and length is 0.

BUG=chromium:505778
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1216853003

Cr-Commit-Position: refs/heads/master@{#29388}

This makes sure that both, the shared function info and it's optimized
code map get revisited when the code map is evicted from the flusher.

R=hpayer@chromium.org
TEST=mjsunit/debug-set-variable-value

Review URL: https://codereview.chromium.org/14703009

Cr-Commit-Position: refs/heads/master@{#29387}

BUG=

Review URL: https://codereview.chromium.org/1214333002

Cr-Commit-Position: refs/heads/master@{#29386}

R=verwaest@chromium.org
BUG=chromium:505370
LOG=N

Review URL: https://codereview.chromium.org/1218023002

Cr-Commit-Position: refs/heads/master@{#29385}

Revert "Revert relanded strong property access CL"

Regression issues should be solved. Initial patchset is the original, subsequent patchsets are the fixing modifications.

This reverts commit 4ac7be56.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1199983002

Cr-Commit-Position: refs/heads/master@{#29384}

Revert of Let GC select the collector when the external memory allocation limit is reached (patchset #1 id:1 of https://codereview.chromium.org/1201993002/)

Reason for revert:
results in a scavenge storm if scavenge doesn't free enough memory

Original issue's description:
> Let GC select the collector when the external memory allocation limit is reached
>
> BUG=none
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/93d6216099b60e95bc816bcc913f8f841ee795b6
> Cr-Commit-Position: refs/heads/master@{#29235}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1215513004

Cr-Commit-Position: refs/heads/master@{#29383}

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1216073004

Cr-Commit-Position: refs/heads/master@{#29382}

Also fixes a crankshaft bug with strong implicit conversions.

It turns out that the implicit conversion of oddball values
is smushed into so many places in crankshaft that it would
have been pretty invasive surgery to make everything fall
out naturally.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1216463003

Cr-Commit-Position: refs/heads/master@{#29381}

Move the arithmetic shift from Int32MulHigh to a following Int32Add on ARM64.
This graph is commonly generated on reduction of signed integer division.

Review URL: https://codereview.chromium.org/1209413008

Cr-Commit-Position: refs/heads/master@{#29380}

BUG=

Review URL: https://codereview.chromium.org/1221643004

Cr-Commit-Position: refs/heads/master@{#29379}

This change makes possible to save and restore the FP registers
in the Prologue and Return parts for the CallAddress kind functions.

TEST=test-simplified-lowering/RunNumberDivide_2_TruncatingToUint32,
     test-simplified-lowering/RunNumberMultiply_TruncatingToUint32

Review URL: https://codereview.chromium.org/1191513003

Cr-Commit-Position: refs/heads/master@{#29378}

BUG=chromium:504875
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1215103003

Cr-Commit-Position: refs/heads/master@{#29377}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1213383002

Cr-Commit-Position: refs/heads/master@{#29376}

R=machenbach@chromium.org
BUG=v8:4135
NOTRY=true
LOG=N

Review URL: https://codereview.chromium.org/1217993002

Cr-Commit-Position: refs/heads/master@{#29375}

The deoptimizer (and probably various other places) cannot deal properly
with recursive function inlining, so we disallow it in TurboFan as well.
We might want to reconsider that decision at some point in the future.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1211243007

Cr-Commit-Position: refs/heads/master@{#29374}

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1214303002

Cr-Commit-Position: refs/heads/master@{#29373}

Reland of https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1214483008

Cr-Commit-Position: refs/heads/master@{#29372}

BUG=

Review URL: https://codereview.chromium.org/1213773002

Cr-Commit-Position: refs/heads/master@{#29371}

R=mvstanton@chromium.org
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1214953003

Cr-Commit-Position: refs/heads/master@{#29370}

BUG=chromium:505007
LOG=N

Review URL: https://codereview.chromium.org/1219693003

Cr-Commit-Position: refs/heads/master@{#29369}

Also removed some unused classes.

BUG=

Review URL: https://codereview.chromium.org/1212643010

Cr-Commit-Position: refs/heads/master@{#29368}

This has become necessary as we have more experimental natives
that run after deserializing from the snapshot.

R=hpayer@chromium.org
BUG=v8:4200
LOG=N

Review URL: https://codereview.chromium.org/1218973002

Cr-Commit-Position: refs/heads/master@{#29367}

Ideally inliner itself should not deal with context specialization at
all, since this is all handled in the pipeline instead (actually
inlining already runs together with context specialization), and the
inlining logic should not care about the specialization mode.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1217973003

Cr-Commit-Position: refs/heads/master@{#29366}

This optimization never triggers currently, and is inherently native
context dependent for no real reason (for example it will not properly
detect those constructors in the case of cross native context inlining),
plus it is slow and awkward.  In case we really need this functionality
at some point, we should find a way to make it work with the builtin
function id mechanism that is already in place to match other builtins.

R=jarin@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/1221683006

Cr-Commit-Position: refs/heads/master@{#29365}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1221753002

Cr-Commit-Position: refs/heads/master@{#29364}

TBR=brucedawson@chromium.org

Review URL: https://codereview.chromium.org/1212613006

Cr-Commit-Position: refs/heads/master@{#29363}

This makes sure that the exit control flow that merges the try-block
with the catch-block after a try-catch-statement creates a new merge
node in cases where it has to. Otherwise dangling phi nodes might have
the wrong number of value inputs.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-505354
BUG=chromium:505354
LOG=N

Review URL: https://codereview.chromium.org/1213183003

Cr-Commit-Position: refs/heads/master@{#29362}

The failure was been triggered by turning on --harmony-arrays,
maybe because code size was increased or code was added later
in the bootstrap process. Because it doesn't look like a bug
in anything guarded by --harmony-arrays directly, I'd suggest
shipping the flag and disabling the test on the architectures
where it's been observed to fail. It's already disabled on arm64
and this patch disables it on mips64 as well.

BUG=v8:4200
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1212963004

Cr-Commit-Position: refs/heads/master@{#29361}

Port 7a63bf77

Original commit message:
This makes new.target work in [[Call]] and [[Construct]] of ordinary
functions.

We achieve this by introducing a new construct stub for functions that
uses the new.target variable. The construct stub pushes the original
constructor just above the receiver in the construct frame.

R=arv@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1213303002

Cr-Commit-Position: refs/heads/master@{#29360}

BUG=v8:3887
LOG=N
R=caitpotter88@gmail.com, adamk@chromium.org

Review URL: https://codereview.chromium.org/1215973005

Cr-Commit-Position: refs/heads/master@{#29359}

This makes new.target work in [[Call]] and [[Construct]] of ordinary
functions.

We achieve this by introducing a new construct stub for functions that
uses the new.target variable. The construct stub pushes the original
constructor just above the receiver in the construct frame.

BUG=v8:3887
LOG=N
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1203813002

Cr-Commit-Position: refs/heads/master@{#29358}

We were calling the setter for Object.prototype.promise if it existed
when calling PromiseAll.

BUG=v9:4232
LOG=N
R=rossberg@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1219623005

Cr-Commit-Position: refs/heads/master@{#29357}