The flag in question is a debug-only flag supported by full-codegen and
Crankshaft only. In it's current form there are some unresolved issues:
- The flag is defeated by inlining in Crankshaft.
- The flag is not supported by TurboFan.
- The flag is not supported by Ignition.

Instead of addressing the above issues and increasing maintenance cost
for all backends and also given the "slim" test coverage, this CL fully
removes the support from all backends.

R=bmeurer@chromium.org,jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1676263002

Cr-Commit-Position: refs/heads/master@{#33817}

Generally we only care whether the next object is a hidden prototype.
It's simpler to check whether the current object has a hidden prototype
instead of walking to the next prototype and checking its map.

BUG=

Review URL: https://codereview.chromium.org/1675223002

Cr-Commit-Position: refs/heads/master@{#33816}

This allows us to remove the somewhat awkward BuildLoadObjectField
from the AstGraphBuilder and also allows us to simplify fullcodegen
for class literals.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1679813002

Cr-Commit-Position: refs/heads/master@{#33815}

Revert of Do not eagerly instantiate accessors' JSFunction. (patchset #9 id:180001 of https://codereview.chromium.org/1609233002/ )

Reason for revert:
[Sheriff] Breaks gcmole:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/6260

Original issue's description:
> Do not eagerly instantiate accessors' JSFunction.
>
> BUG=
>
> Committed: https://crrev.com/4d46b510caf534d770ce19a01a11b8796304471b
> Cr-Commit-Position: refs/heads/master@{#33812}

TBR=verwaest@chromium.org,epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1679683004

Cr-Commit-Position: refs/heads/master@{#33814}

This moves the JSCreate related functionality from JSTypedLowering into
a dedicated JSCreateLowering reducer. This is in preparation of landing
the support for optimized literals in TurboFan, which would blow up
JSTypedLowering quite seriously otherwise.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1678833002

Cr-Commit-Position: refs/heads/master@{#33813}

BUG=

Review URL: https://codereview.chromium.org/1609233002

Cr-Commit-Position: refs/heads/master@{#33812}

BUG=

Review URL: https://codereview.chromium.org/1678043002

Cr-Commit-Position: refs/heads/master@{#33811}

The serializer collects objects in iteration order, not in allocation
order. This means that the deserializer will put these objects in
iteration order onto the reserved pages as well. There is no guarantee
that objects that were on the first page will end up on the first page
after deserialization.

Until now we got lucky, since we only ever need one space per page for
the default snapshot. For roots, the iteration order and allocation
order also do not differ enough to cause any issue for immortal
immovable root objects. These objects need to stay on the first page of
its allocated space to not move.

However, let's make sure it stays this way, and we realize soon enough
if this assumption does not hold.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1675553002

Cr-Commit-Position: refs/heads/master@{#33810}

Replace the somewhat awkward RestParamAccessStub, which would always
call into the runtime anyway with a proper FastNewRestParameterStub,
which is basically based on the code that was already there for strict
arguments object materialization. But for rest parameters we could
optimize even further (leading to 8-10x improvements for functions with
rest parameters), by fixing the internal formal parameter count:

Every SharedFunctionInfo has a formal_parameter_count field, which
specifies the number of formal parameters, and is used to decide whether
we need to create an arguments adaptor frame when calling a function
(i.e. if there's a mismatch between the actual and expected parameters).
Previously the formal_parameter_count included the rest parameter, which
was sort of unfortunate, as that meant that calling a function with only
the non-rest parameters still required an arguments adaptor (plus some
other oddities). Now with this CL we fix, so that we do no longer
include the rest parameter in that count. Thereby checking for rest
parameters is very efficient, as we only need to check whether there is
an arguments adaptor frame, and if not create an empty array, otherwise
check whether the arguments adaptor frame has more parameters than
specified by the formal_parameter_count.

The FastNewRestParameterStub is written in a way that it can be directly
used by Ignition as well, and with some tweaks to the TurboFan backends
and the CodeStubAssembler, we should be able to rewrite it as
TurboFanCodeStub in the near future.

Drive-by-fix: Refactor and unify the CreateArgumentsType which was
different in TurboFan and Ignition; now we have a single enum class
which is used in both TurboFan and Ignition.

R=jarin@chromium.org, rmcilroy@chromium.org
TBR=rossberg@chromium.org
BUG=v8:2159
LOG=n

Review URL: https://codereview.chromium.org/1676883002

Cr-Commit-Position: refs/heads/master@{#33809}

Fix failures on MIPS simulator because incomplete
handling of MTHC1 and MFHC1 in Fp32 mode
Fix failures on older kernels that have problems with
MTHC1 and MFHC1 in kernel FPU emulation

Original issue's description:
> Revert of MIPS: Add FPXX support to MIPS32R2 (patchset #3
> id:40001 of https://codereview.chromium.org/1586223004/ )
>
> Reason for revert:
> Revert patch due to a number of failures appearing on the > MIPS v8 simulator
>
> Original issue's description:
>> MIPS: Add FPXX support to MIPS32R2
>>
>> The JIT code generated by V8 is FPXX compliant
>> when v8 compiled with FPXX flag. This allows the code to
>> run in both FP=1 and FP=0 mode. It also alows v8 to be used
>> as a library by both FP32 and FP64 binaries.
>>
>> BUG=
>>
>> Committed: https://crrev.com/95110dde666158a230a823fd50a68558ad772320
>> Cr-Commit-Position: refs/heads/master@{#33576}

BUG=

Review URL: https://codereview.chromium.org/1659883002

Cr-Commit-Position: refs/heads/master@{#33808}

This is effectively a port of 4eff883b (r27731).

BUG=

Review URL: https://codereview.chromium.org/1671883003

Cr-Commit-Position: refs/heads/master@{#33807}

This replaces the global remembered set with per-page remembered sets.

Each page in the old space, map space, and large object space keeps track of
the set of slots in the page pointing to the new space.

The data structure for storing slot sets is a two-level bitmap, which allows
us to remove the store buffer overflow and SCAN_ON_SCAVENGE logic.

Design doc: https://goo.gl/sMKCf7

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1608583002

Cr-Commit-Position: refs/heads/master@{#33806}

This speeds up base constructor instantiation by ~3x.

BUG=

Review URL: https://codereview.chromium.org/1673163002

Cr-Commit-Position: refs/heads/master@{#33805}

Useful for example for using atomicops_internal_portable.h on Android.

BUG=v8:4615
LOG=y

patch from issue 1525813002 at patchset 1 (http://crrev.com/1525813002#ps1)

Review URL: https://codereview.chromium.org/1637473003

Cr-Commit-Position: refs/heads/master@{#33804}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1674023003

Cr-Commit-Position: refs/heads/master@{#33803}

The preallocated JSAccessorPropertyDescriptor, JSDataPropertyDescriptor and
JSIteratorResult had the constructor field unset, which in turn causes
GetCreationContext() to fail for those instances.

R=verwaest@chromium.org
BUG=v8:4738
LOG=n

Review URL: https://codereview.chromium.org/1676823002

Cr-Commit-Position: refs/heads/master@{#33802}

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1674153002

Cr-Commit-Position: refs/heads/master@{#33801}

It's fine to use JS_OBJECT_TYPE for JSIteratorResult and only have a
preallocated initial map for them to avoid unnecessary polymorphism
from generators / builtin iterators. The instance type doesn't
provide any advantage, since we always have to treat JSIteratorResult
objects as regular JSObjects later.

R=yangguo@chromium.org
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1680513002

Cr-Commit-Position: refs/heads/master@{#33800}

Rolling v8/build/gyp to 57190fa278689da857c6dfd6b4886dbfddce98ce

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1679673002

Cr-Commit-Position: refs/heads/master@{#33799}

[api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.

Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.

The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.

BUG=chromium:579009
LOG=Y

Committed: https://crrev.com/6a118774244d087b5979e9291d628a994f21d59d
Cr-Commit-Position: refs/heads/master@{#33674}

Review URL: https://codereview.chromium.org/1642223003

Cr-Commit-Position: refs/heads/master@{#33798}

BUG=

Review URL: https://codereview.chromium.org/1627263002

Cr-Commit-Position: refs/heads/master@{#33797}

BUG=

Review URL: https://codereview.chromium.org/1628133002

Cr-Commit-Position: refs/heads/master@{#33796}

Rolling v8/tools/clang to f0dada1961030974d4da5591b1fef8cf42bded15

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1672993002

Cr-Commit-Position: refs/heads/master@{#33795}

  port 334d1794 (r33780)

  original commit message:
  This change should unify handling of finally blocks in Turbofan's
  AstGraphBuilder and in full-code. This should enable smooth deoptimization
  from finally blocks.

BUG=

Review URL: https://codereview.chromium.org/1675003002

Cr-Commit-Position: refs/heads/master@{#33794}

R=bradnelson@chromium.org
BUG=https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm.js
LOG=N

Review URL: https://codereview.chromium.org/1675903002

Cr-Commit-Position: refs/heads/master@{#33793}

Port 334d1794

Original commit message:

    This change should unify handling of finally blocks in Turbofan's
    AstGraphBuilder and in full-code. This should enable smooth deoptimization
    from finally blocks.

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1669373002

Cr-Commit-Position: refs/heads/master@{#33792}

Cr-Commit-Position: refs/heads/master@{#33791}

BUG=
TEST=cctest/test-assembler-mips/min_max, cctest/test-assembler-mips/mina_maxa, cctest/test-assembler-mips64/min_max, cctest/test-assembler-mips64/mina_maxa

Review URL: https://codereview.chromium.org/1668143002

Cr-Commit-Position: refs/heads/master@{#33790}

We assume split-edge form throughout the register allocation pipeline,
so added validation in isel.

BUG=

Review URL: https://codereview.chromium.org/1668953002

Cr-Commit-Position: refs/heads/master@{#33789}

The call can be used by the embedder to provide information on the workers
executing background tasks.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1664203004

Cr-Commit-Position: refs/heads/master@{#33788}

Revert of [es7] refactor and fix Object.values() / Object.entries() (patchset #6 id:100001 of https://codereview.chromium.org/1637753004/ )

Reason for revert:
[Sheriff] Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/1642

Original issue's description:
> [es7] refactor and fix Object.values() / Object.entries()
>
> Previously, Object.values() and Object.entries() were piggy-backing on
> Object.keys(). This meant that they would pre-filter non-enumerable properties,
> violating the runtime behaviour of the methods. Unfortunately, this does not
> match the current proposal text.
>
> Also incorporates several tests verifying this behaviour based on tests included
> in the ChakraCore implementation.
>
> BUG=v8:4663
> LOG=N
> R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org
>
> Committed: https://crrev.com/5c5ccd9d7f8693990d1a9eb26ba3a94f376dcf0b
> Cr-Commit-Position: refs/heads/master@{#33782}

TBR=littledan@chromium.org,adamk@chromium.org,cbruni@chromium.org,rossberg@chromium.org,caitpotter88@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4663

Review URL: https://codereview.chromium.org/1675663002

Cr-Commit-Position: refs/heads/master@{#33787}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1671623005

Cr-Commit-Position: refs/heads/master@{#33786}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1671653002

Cr-Commit-Position: refs/heads/master@{#33785}

Before:

REX.W cmpq r9,r8
setzl r8l
movzxbl r8,r8
REX.W cmpq r8,0x0
jz 185

After:

REX.W cmpq r9,r8
jnz 149

Review URL: https://codereview.chromium.org/1677503002

Cr-Commit-Position: refs/heads/master@{#33784}

To avoid returning a signaling NaN the result is multiplied by 1.0.

R=titzer@chromium.org, binji@chromium.org

BUG=4733
LOG=Y

Review URL: https://codereview.chromium.org/1673583002

Cr-Commit-Position: refs/heads/master@{#33783}

Previously, Object.values() and Object.entries() were piggy-backing on
Object.keys(). This meant that they would pre-filter non-enumerable properties,
violating the runtime behaviour of the methods. Unfortunately, this does not
match the current proposal text.

Also incorporates several tests verifying this behaviour based on tests included
in the ChakraCore implementation.

BUG=v8:4663
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1637753004

Cr-Commit-Position: refs/heads/master@{#33782}

This makes the dispatch table similar to the builtins code list and makes
sure that the dispatch table does not move.

R=mstarzinger@chromium.org, rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1671813003

Cr-Commit-Position: refs/heads/master@{#33781}

This change should unify handling of finally blocks in Turbofan's
AstGraphBuilder and in full-code. This should enable smooth deoptimization
from finally blocks.

Review URL: https://codereview.chromium.org/1663323003

Cr-Commit-Position: refs/heads/master@{#33780}

This makes the field in question more generic by renaming it from the
previous "depth" to "data". Pure refactoring, no function change.

R=rmcilroy@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1670983003

Cr-Commit-Position: refs/heads/master@{#33779}

The CL 33579 (https://codereview.chromium.org/1618343002) use code offsets instead of raw PC where possible.

But the offset maybe come from an optimized frame, not the un-optimized frame that FromCodeOffset and BreakIndexFromCodeOffset function expect.
So The offset from optimized frame can't be used in FromCodeOffset and  BreakIndexFromCodeOffset function.

This CL use the frame summary to find the corresponding code offset in unoptimized code according to Yang's suggestion.

Review URL: https://codereview.chromium.org/1663113002

Cr-Commit-Position: refs/heads/master@{#33778}