Port caeb9004

Original commit message:
If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com

Review URL: https://codereview.chromium.org/1110623002

Cr-Commit-Position: refs/heads/master@{#28089}

Revert of Make it possible to hoist the neutering check for TA property accesses (patchset #1 id:1 of https://codereview.chromium.org/1107993002/)

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3403

Original issue's description:
> Make it possible to hoist the neutering check for TA property accesses
>
> Also correctly set up the dependency between propoerty and elements
> accesses and the checks
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/6a62e321381e1a212983804c4197068e842b240f
> Cr-Commit-Position: refs/heads/master@{#28087}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1108823003

Cr-Commit-Position: refs/heads/master@{#28088}

Also correctly set up the dependency between propoerty and elements
accesses and the checks

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107993002

Cr-Commit-Position: refs/heads/master@{#28087}

Revert of Preprocess structured stack trace on GC to get rid of code reference. (patchset #5 id:80001 of https://codereview.chromium.org/1103843002/)

Reason for revert:
Broke GCStress

Original issue's description:
> Preprocess structured stack trace on GC to get rid of code reference.
>
> R=verwaest@chromium.org
> BUG=v8:2340
> LOG=N
>
> Committed: https://crrev.com/462ffa1dfa0ab3a851ea0294470d1ed7ed12dd56
> Cr-Commit-Position: refs/heads/master@{#28085}

TBR=verwaest@chromium.org,ulan@chromium.org,hpayer@chromium.org,yurys@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2340

Review URL: https://codereview.chromium.org/1102383002

Cr-Commit-Position: refs/heads/master@{#28086}

R=verwaest@chromium.org
BUG=v8:2340
LOG=N

Review URL: https://codereview.chromium.org/1103843002

Cr-Commit-Position: refs/heads/master@{#28085}

Just a refactoring, real pattern parsing comes in a later CL.

R=rossberg@chromium.org,marja@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1066933005

Cr-Commit-Position: refs/heads/master@{#28084}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1105133002

Cr-Commit-Position: refs/heads/master@{#28083}

BUG=chromium:481433
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1104113002

Cr-Commit-Position: refs/heads/master@{#28082}

R=verwaest@chromium.org
BUG=468620
LOG=N

Review URL: https://codereview.chromium.org/1102543002

Cr-Commit-Position: refs/heads/master@{#28081}

This CL changes GetHeapSpaceStatistics api to return SizeOfObjects()
instead of Size(). SizeOfObjects is the required field and is
consistent with GetHeapStatistics api.

BUG=476013
LOG=N

Review URL: https://codereview.chromium.org/1095393005

Cr-Commit-Position: refs/heads/master@{#28080}

Revert of deprecate non-phantom weak callbacks (patchset #1 id:1 of https://codereview.chromium.org/1103173002/)

Reason for revert:
[Sheriff] Fails compilation on chromium android:
http://build.chromium.org/p/client.v8/builders/Android%20Builder/builds/4131

Is the chromium version our builder used maybe too old (it uses lkcr)? In that case please reland as soon as it's up-to-date.

Original issue's description:
> deprecate non-phantom weak callbacks
>
> BUG=
>
> Committed: https://crrev.com/39c31da2142ab0fca9dae279b9e59cd4951a1982
> Cr-Commit-Position: refs/heads/master@{#28077}

TBR=jochen@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1104163002

Cr-Commit-Position: refs/heads/master@{#28079}

Reland [test] Make msan work for v8 stand-alone. (patchset #1 id:1 of https://codereview.chromium.org/1104073002/)

Reason for revert:
Reland after switching bot to ninja.

Original issue's description:
> Revert of [test] Make msan work for v8 stand-alone. (patchset #6 id:100001 of https://codereview.chromium.org/802583003/)
>
> Reason for revert:
> Compile failures: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2047
>
> Original issue's description:
> > [test] Make msan work for v8 stand-alone.
> >
> > The msan configuration can be used in combination with
> > v8_use_snapshot=false.
> >
> > BUG=chromium:425187
> > LOG=n
> >
> > Committed: https://crrev.com/a65ef0d53fc28b0908f228938c6d84effa83c596
> > Cr-Commit-Position: refs/heads/master@{#28064}
>
> TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:425187
>
> Committed: https://crrev.com/f69a48696ec3ec0ea1169a41b4c84fb36b059968
> Cr-Commit-Position: refs/heads/master@{#28068}

TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:425187

Review URL: https://codereview.chromium.org/1102323002

Cr-Commit-Position: refs/heads/master@{#28078}

BUG=

Review URL: https://codereview.chromium.org/1103173002

Cr-Commit-Position: refs/heads/master@{#28077}

...when handing out validity cells to handlers; because invalidating said cells is
the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after
the recently introduced compaction support.

This reverts commit 968715c6.

Original review: https://codereview.chromium.org/1104813004/

Review URL: https://codereview.chromium.org/1110513002

Cr-Commit-Position: refs/heads/master@{#28076}

- instead of committing operands early to resolve hints, hold the hint register data on the UsePosition
- allow hints to be rolled back efficiently as needed by GreedyAllocator
- some small drive by fixes

BUG=

Review URL: https://codereview.chromium.org/1103533002

Cr-Commit-Position: refs/heads/master@{#28075}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1106633002

Cr-Commit-Position: refs/heads/master@{#28074}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1110503002

Cr-Commit-Position: refs/heads/master@{#28073}

R=mstarzinger@chromium.org
LOG=N
BUG=N

Review URL: https://codereview.chromium.org/1110473003

Cr-Commit-Position: refs/heads/master@{#28072}

The debug event BreakForCommand is now deprecated, as it cannot happen any longer.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1089893002

Cr-Commit-Position: refs/heads/master@{#28071}

BUG=

Review URL: https://codereview.chromium.org/1105023002

Cr-Commit-Position: refs/heads/master@{#28070}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1105043002

Cr-Commit-Position: refs/heads/master@{#28069}

Revert of [test] Make msan work for v8 stand-alone. (patchset #6 id:100001 of https://codereview.chromium.org/802583003/)

Reason for revert:
Compile failures: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2047

Original issue's description:
> [test] Make msan work for v8 stand-alone.
>
> The msan configuration can be used in combination with
> v8_use_snapshot=false.
>
> BUG=chromium:425187
> LOG=n
>
> Committed: https://crrev.com/a65ef0d53fc28b0908f228938c6d84effa83c596
> Cr-Commit-Position: refs/heads/master@{#28064}

TBR=jochen@chromium.org,earthdok@chromium.org,svenpanne@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:425187

Review URL: https://codereview.chromium.org/1104073002

Cr-Commit-Position: refs/heads/master@{#28068}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1106963002

Cr-Commit-Position: refs/heads/master@{#28067}

Also do some drive-by-cleanup to the unittests.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1107883002

Cr-Commit-Position: refs/heads/master@{#28066}

BUG=chromium:478556
LOG=n

Review URL: https://codereview.chromium.org/1107853002

Cr-Commit-Position: refs/heads/master@{#28065}

The msan configuration can be used in combination with
v8_use_snapshot=false.

BUG=chromium:425187
LOG=n

Review URL: https://codereview.chromium.org/802583003

Cr-Commit-Position: refs/heads/master@{#28064}

Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer. (patchset #10 id:180001 of https://codereview.chromium.org/1063513003/)

Reason for revert:
[sheriff] Breaks nosnap debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/156

Original issue's description:
> [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
>
> Uses lazy deoptimization and code dependencies to introduce loads
> from property cells and also to promote globals to constants.
>
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://crrev.com/aae4a62d07e839455b1d0ad4fa512cc5d48a1a68
> Cr-Commit-Position: refs/heads/master@{#28057}

TBR=mstarzinger@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1084533003

Cr-Commit-Position: refs/heads/master@{#28063}

This uses explicit operators instead of intrinsic runtime calls to
create literals froms boilerplates. It allows for easier access of
static parameters and syncs it with other allocating operators.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1104453006

Cr-Commit-Position: refs/heads/master@{#28062}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1109733002

Cr-Commit-Position: refs/heads/master@{#28061}

Original description:
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107843002

Cr-Commit-Position: refs/heads/master@{#28060}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1084243005

Cr-Commit-Position: refs/heads/master@{#28059}

This introduces a JSCreateClosure operator which can be lowered by the
typed pipeline to the aforementioned stub. It also allows for further
optimizations of closure creation.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1105513002

Cr-Commit-Position: refs/heads/master@{#28058}

Uses lazy deoptimization and code dependencies to introduce loads
from property cells and also to promote globals to constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1063513003

Cr-Commit-Position: refs/heads/master@{#28057}

If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}

BUG=

Review URL: https://codereview.chromium.org/1095203005

Cr-Commit-Position: refs/heads/master@{#28055}

This changes the unittests suite to be run in only the default variant,
because unit tests are (and should be) written to be independent from
global flags.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1067863007

Cr-Commit-Position: refs/heads/master@{#28054}

When splitting live ranges between interval boundary,
the intervals still link eachother. This fixes that.

BUG=

Review URL: https://codereview.chromium.org/1102243002

Cr-Commit-Position: refs/heads/master@{#28053}

Rolling v8/tools/clang to cb9ddad752c487e2f4df2bf32df70daaa9afded5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1103043002

Cr-Commit-Position: refs/heads/master@{#28052}

Rolling v8/buildtools to 15308f469a704c45d15567fa69cd94ce07ad0e1b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1107773002

Cr-Commit-Position: refs/heads/master@{#28051}

This reverts commit d5565c1f.

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

This also moves the logic for handling symbols from runtime-function.cc
to v8natives.js.

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1093183006

Cr-Commit-Position: refs/heads/master@{#28050}