R=bradnelson@chromium.org
BUG=https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm.js
LOG=N

Review URL: https://codereview.chromium.org/1664993002

Cr-Commit-Position: refs/heads/master@{#33713}

This removes --harmony-completion, --harmony-concat-spreadable, and
--harmony-tolength and moves the appropriate tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1667453002

Cr-Commit-Position: refs/heads/master@{#33712}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1663133002

Cr-Commit-Position: refs/heads/master@{#33711}

Port 44ec23ac

R=hpayer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1669463002

Cr-Commit-Position: refs/heads/master@{#33710}

A lot of deverlopers use deprecated sourceURL syntax. We should add console warning message before removing this.
Original CL: https://codereview.chromium.org/1495633002/

BUG=chromium:558998
LOG=Y
R=yangguo@chromium.org,hablich@chromium.org,adamk@chromium.org

Review URL: https://codereview.chromium.org/1654223003

Cr-Commit-Position: refs/heads/master@{#33709}

Skips cctest/test-heap/NoWeakHashTableLeakWithIncrementalMarking
that is crashing on arm64.

BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1660613005

Cr-Commit-Position: refs/heads/master@{#33708}

Unifies the meaning of kRegCount8 and kRegCount16 across bytecodes.
Call and CallJSRuntime had a slightly different use of the register
count operand. From this change forth, register count operands are
always based off of the previous register operand.

BUG=v8:4280,v8:4675
LOG=N

Review URL: https://codereview.chromium.org/1659023002

Cr-Commit-Position: refs/heads/master@{#33707}

BUG=v8:4717
LOG=N

Review URL: https://codereview.chromium.org/1663543003

Cr-Commit-Position: refs/heads/master@{#33706}

Adds implementation and tests for with statement to interprter.

BUG=v8:4280,v8:4684
LOG=N

Review URL: https://codereview.chromium.org/1656863002

Cr-Commit-Position: refs/heads/master@{#33705}

This clears the currently pending message object whenever a try-block or
a finally-block is being entered in interpreted code. The intention is
to avoid memory leaks introduced by the message object. Also the message
object is being restored when a finally-block exits.

R=rmcilroy@chromium.org
TEST=cctest/test-heap/MessageObjectLeak
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1651993002

Cr-Commit-Position: refs/heads/master@{#33704}

BUG=

Review URL: https://codereview.chromium.org/1628453002

Cr-Commit-Position: refs/heads/master@{#33703}

R=ahaas@chromium.org,jfb@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1661713003

Cr-Commit-Position: refs/heads/master@{#33702}

This was inconsistent in the spec in case of has vs get, set. Removing
receiver==holder simplifies the lookup; so tentatively removing this
additional check which was broken until yesterday anyway. See
https://github.com/tc39/ecma262/issues/347 for more information.

Review URL: https://codereview.chromium.org/1660903002

Cr-Commit-Position: refs/heads/master@{#33701}

Now that we have full fledged module instantiation,
keeping alive a second interface seems clunky.

Droping it and switching the tests.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm,other wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1660083002

Cr-Commit-Position: refs/heads/master@{#33700}

BUG=none
R=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1653423002

Cr-Commit-Position: refs/heads/master@{#33699}

Revert of [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a … (patchset #3 id:80001 of https://codereview.chromium.org/1642223003/ )

Reason for revert:
Fails a lot of layout tests and blocks the roll. Can be easily reproduced with a local Chromium checkout.

Reference: https://codereview.chromium.org/1652413003/

Original issue's description:
> [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.
>
> Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
> When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
> ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.
>
> The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.
>
> This CL also prohibits non-primitive properties in ObjectTemplate to avoid potential cross-context leaks.
>
> BUG=chromium:579009
> LOG=Y
>
> Committed: https://crrev.com/6a118774244d087b5979e9291d628a994f21d59d
> Cr-Commit-Position: refs/heads/master@{#33674}

TBR=verwaest@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:579009

Review URL: https://codereview.chromium.org/1660263003

Cr-Commit-Position: refs/heads/master@{#33698}

BUG=chromium:583260
LOG=n

Review URL: https://codereview.chromium.org/1664683002

Cr-Commit-Position: refs/heads/master@{#33697}

Reland of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #1 id:1 of https://codereview.chromium.org/1661723003/ )

Reason for revert:
Bisection results show that this was not the culprit.

Original issue's description:
> Revert of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #2 id:80001 of https://codereview.chromium.org/1653973003/ )
>
> Reason for revert:
> Very likely blocking roll: https://codereview.chromium.org/1652413003/
>
> Original issue's description:
> > [heap] Simplify distribution of remaining memory during sweeping & compaction
> >
> > BUG=chromium:524425
> > LOG=N
> >
> > Committed: https://crrev.com/f72923526ccaa8faef5c977267b0c074c4a44dfa
> > Cr-Commit-Position: refs/heads/master@{#33668}
>
> TBR=hpayer@chromium.org,mlippautz@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/a9441b0e7a2a56c2047482a3cc66e3ca2255444b
> Cr-Commit-Position: refs/heads/master@{#33695}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1663013002

Cr-Commit-Position: refs/heads/master@{#33696}

Revert of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #2 id:80001 of https://codereview.chromium.org/1653973003/ )

Reason for revert:
Very likely blocking roll: https://codereview.chromium.org/1652413003/

Original issue's description:
> [heap] Simplify distribution of remaining memory during sweeping & compaction
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/f72923526ccaa8faef5c977267b0c074c4a44dfa
> Cr-Commit-Position: refs/heads/master@{#33668}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1661723003

Cr-Commit-Position: refs/heads/master@{#33695}

We always call GetCallerArguments with 0 for prefix_argc, and so there's
no use in having that parameter at all.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1662953002

Cr-Commit-Position: refs/heads/master@{#33694}

R=jarin@chromium.org
BUG=chromium:582703
LOG=n

Review URL: https://codereview.chromium.org/1664483003

Cr-Commit-Position: refs/heads/master@{#33693}

Rolling v8/base/trace_event/common to 4b09207e447ae5bd34643b4c6321bee7b76d35f9

Rolling v8/third_party/icu to 8f91ea3a7e0413df3312204058da856058a8099b

Rolling v8/tools/clang to 003558cb5f46e54fdbf5d14507f5c233d2ea91e6

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1665713002

Cr-Commit-Position: refs/heads/master@{#33692}

As it turns out checking for bare Type::Function is problematic,
switching to use Type::Function(Type::Any())).

Also labeling the type on foreign function declarations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1652963004

Cr-Commit-Position: refs/heads/master@{#33691}

R=machenbach@chromium.org
BUG=chromium:474921
LOG=n

Review URL: https://codereview.chromium.org/1658223002

Cr-Commit-Position: refs/heads/master@{#33690}

This includes 2 fixes:
1) We didn't properly advance the holder when checking whether
Receiver==Holder, so we'd inadvertently block loading the property if
the first property we find is on the typed array.
2) Reflect.get may cause any object on the prototype chain of the holder
to be the receiver; so we need to recheck for this special state for
each object we perform lookup on.

Review URL: https://codereview.chromium.org/1651913005

Cr-Commit-Position: refs/heads/master@{#33689}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1649743002

Cr-Commit-Position: refs/heads/master@{#33688}

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1654263004

Cr-Commit-Position: refs/heads/master@{#33687}

Moves the temporary register allocator out of the bytecode array
builder into TemporaryRegisterAllocator class and adds unittests.
Particular must be taken around the translation window boundary
motivating the addition of tests.

Also adds a Clear() method to IdentityMap() which is called by
the destructor. This allows classes to hold an IdentityMap if
they are zone allocated. Classes must call Clear() before the zone
is re-cycled or face v8 heap corruption.

BUG=v8:4280,v8:4675
LOG=N

Review URL: https://codereview.chromium.org/1651133002

Cr-Commit-Position: refs/heads/master@{#33686}

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1657593008

Cr-Commit-Position: refs/heads/master@{#33685}

BUG=

Review URL: https://codereview.chromium.org/1652003002

Cr-Commit-Position: refs/heads/master@{#33684}

BUG=chromium:583257
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1651253003

Cr-Commit-Position: refs/heads/master@{#33683}

Move all the code that deals with falling back to object creation via
stubs to JSGenericLowering, where we can already deal well with stub
calls. This includes JSCreateLiteralArray, JSCreateLiteralObject,
JSCreateClosure, JSCreateFunctionContext and JSCreateArray.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1653353002

Cr-Commit-Position: refs/heads/master@{#33682}

This removes an unnecessary gclient-sync for chromium, which
makes the bots die when network is slow.

NOTRY=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1658043003

Cr-Commit-Position: refs/heads/master@{#33681}

We don't have proper test coverage for the no-deoptimization code paths
in the JSGlobalObjectSpecialization reducer, and we will properly never
have any use for that code, so it just adds complexity and code that
likely breaks over time (as its untested).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1659463007

Cr-Commit-Position: refs/heads/master@{#33680}

NOTRY=true

Review URL: https://codereview.chromium.org/1658193002

Cr-Commit-Position: refs/heads/master@{#33679}

TEST=cctest/test-run-wasm/*, cctest/test-run-wasm-module/*, unittests
BUG=

Review URL: https://codereview.chromium.org/1581223002

Cr-Commit-Position: refs/heads/master@{#33678}

If the architecture does not provide rounding instructions, then C
implementations of these rounding instructions are called. The C
implementations from math.h are used, function pointers are registered
as external references so that they can be call from the simulator.

R=titzer@chromium.org

BUG=575379

LOG=Y

Review URL: https://codereview.chromium.org/1661463002

Cr-Commit-Position: refs/heads/master@{#33677}

Revert of [regexp] implement /ui to mirror the implementation for /i. (patchset #2 id:20001 of https://codereview.chromium.org/1641613002/ )

Reason for revert:
This test fails:

assertEquals(["as"], /^a[\u017F]/ui.exec("as"));

The reason is that we end up with a character class that is not stand alone, so we do not perform case folding on it correctly (with unicode flag).

Original issue's description:
> [regexp] implement /ui to mirror the implementation for /i.
>
> R=erik.corry@gmail.com, erikcorry@chromium.org
>
> Committed: https://crrev.com/eea1a4c003c559c99bcc9f08aa7eadf931975aad
> Cr-Commit-Position: refs/heads/master@{#33655}

TBR=erik.corry@gmail.com,erikcorry@chromium.org,erikcorry@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1661483002

Cr-Commit-Position: refs/heads/master@{#33676}

Avoid the hacking in JSIntrinsicLowering and provide a proper simplified
operator ObjectIsReceiver instead that is used to implement %_IsJSReceiver
which is used by our JavaScript builtins and the JSInliner.

R=jarin@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1657863004

Cr-Commit-Position: refs/heads/master@{#33675}

[api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.

Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.

The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.

This CL also prohibits non-primitive properties in ObjectTemplate to avoid potential cross-context leaks.

BUG=chromium:579009
LOG=Y

Review URL: https://codereview.chromium.org/1642223003

Cr-Commit-Position: refs/heads/master@{#33674}