BUG=chromium:507767
LOG=n

Review URL: https://codereview.chromium.org/1224853003

Cr-Commit-Position: refs/heads/master@{#29528}

We actually need round to zero truncation to implement the counterpart
of LDoubleToI in TurboFan, which tries to convert a double to an integer
as required for keyed load/store optimizations.

Drive-by-cleanup: Reduce some code duplication in the InstructionSelector
implementations.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1225993002

Cr-Commit-Position: refs/heads/master@{#29527}

This flag is on by default but it will allow us to turn that off in
favor of harmony-sloppy in the future.

BUG=v8:3305, v8:2198
LOG=N
R=littledan@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1218803006

Cr-Commit-Position: refs/heads/master@{#29526}

Revert of [d8] bounds-check before getting Shell::Worker internal field (patchset #4 id:80001 of https://codereview.chromium.org/1214053004/)

Reason for revert:
[Sheriff] Fails here:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4737

Original issue's description:
> [d8] bounds-check before getting Shell::Worker internal field
>
> Prevents fatal error in debug builds
>
> BUG=v8:4271
> R=binji@chromium.org
> LOG=N
>
> Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
> Cr-Commit-Position: refs/heads/master@{#29524}

TBR=binji@chromium.org,jochen@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4271

Review URL: https://codereview.chromium.org/1215333012

Cr-Commit-Position: refs/heads/master@{#29525}

Prevents fatal error in debug builds

BUG=v8:4271
R=binji@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29524}

Review URL: https://codereview.chromium.org/1215383002

Cr-Commit-Position: refs/heads/master@{#29523}

BUG=N
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1226443004

Cr-Commit-Position: refs/heads/master@{#29522}

Review URL: https://codereview.chromium.org/1218663009

Cr-Commit-Position: refs/heads/master@{#29521}

Review URL: https://codereview.chromium.org/1222203007

Cr-Commit-Position: refs/heads/master@{#29520}

The RawMachineAssembler will be used to build the interpreter, so it needs
to move back to src/compiler.

This reverts commit b5b00cc0.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1221303014

Cr-Commit-Position: refs/heads/master@{#29519}

If we compile handlers to call accessors, Debug::HandleStepIn won't get
called. Therefore we need to clear ICs each time. This has not been
necessary before because we used to patch ICs for breaking, and restored
them with cleared ICs. This is no longer the case. We do not use ICs
for breaking anymore, so they are not implicitly cleared any longer.

R=mvstanton@chromium.org
BUG=v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1212253009

Cr-Commit-Position: refs/heads/master@{#29518}

Revert "Revert of [test262-es6] Update to 2011-06-29 (patchset #1 id:1 of https://codereview.chromium.org/1220793005/)"

This reverts commit f50fff57.

BUG=N
LOG=N
R=littledan@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1212723004

Cr-Commit-Position: refs/heads/master@{#29517}

This removes various boilouts for super constructor calls from the
TurboFan pipeline and unifies them. It also disables and optimization
which breaks references to uninitialized const this variables.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1222843004

Cr-Commit-Position: refs/heads/master@{#29516}

disregarding the allocation throughput.

BUG=chromium:506132
LOG=NO

Review URL: https://codereview.chromium.org/1213313004

Cr-Commit-Position: refs/heads/master@{#29515}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1224643004

Cr-Commit-Position: refs/heads/master@{#29514}

BUG=v8:4254
LOG=n
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1220333004

Cr-Commit-Position: refs/heads/master@{#29513}

This reverts commit 26991892.
This reverts commit 435b3c87.

The failing test is fixing in chromium.

BUG=chromium:490559
LOG=NO
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1208993009

Cr-Commit-Position: refs/heads/master@{#29512}

We also need to do the check before using an existing handler from the
cache

BUG=chromium:505374
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1221433010

Cr-Commit-Position: refs/heads/master@{#29511}

BUG=v8:4254
LOG=n
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1219013007

Cr-Commit-Position: refs/heads/master@{#29510}

This unifies the existing frame constants that are the same accross all
architectures. It also adds a new kOriginalConstructorOffset constant
for construct frames and uses is in full-codegen.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1220223005

Cr-Commit-Position: refs/heads/master@{#29509}

port a8a4c364 (r29487).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1227603002

Cr-Commit-Position: refs/heads/master@{#29508}

TurboFan OSR installs the CompileOptimized builtin on JSFunctions, which
means that we never evict the OSR code objects for such functions from
eager deopts.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1220813018

Cr-Commit-Position: refs/heads/master@{#29507}

Revert of Fix bug when transferring SharedArrayBuffer to multiple Workers. (patchset #3 id:40001 of https://codereview.chromium.org/1215233004/)

Reason for revert:
[Sheriff] Test hangs sometimes and times out flakily. E.g.: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosse3/builds/4551/steps/Check%20%28flakes%29/logs/d8-worker-sharedarray..

Original issue's description:
> Fix bug when transferring SharedArrayBuffer to multiple Workers.
>
> Previously, the serialization code would call Externalize for every transferred
> ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If
> the buffer is already externalized, we should call GetContents instead.
>
> Also fix use-after-free bug when transferring ArrayBuffers. The transferred
> ArrayBuffer must be internalized in the new isolate, or be managed by the
> Shell. The current code gives it to the isolate externalized and frees it
> immediately afterward when the SerializationData object is destroyed.
>
> BUG=chromium:497295
> R=jarin@chromium.org
> LOG=n
>
> Committed: https://crrev.com/dd7962bf7838f8379ba776ee6b7b0e4d3bec2140
> Cr-Commit-Position: refs/heads/master@{#29499}

TBR=jarin@chromium.org,jochen@chromium.org,binji@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:497295

Review URL: https://codereview.chromium.org/1224843008

Cr-Commit-Position: refs/heads/master@{#29506}

Rolling v8/third_party/icu to c81a1a3989c3b66fa323e9a6ee7418d7c08297af

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1213043007

Cr-Commit-Position: refs/heads/master@{#29505}

port 1fa4285e (r29436).

original commit message:

    This involves:
    - Enabling the tail call optimization reducer in all cases.
    - Adding an addition flag to CallFunctionParameters to mark call sites
      that can be tail-called enabled.
    - Only set the tail-call flag for %_CallFunction.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1228463003

Cr-Commit-Position: refs/heads/master@{#29504}

Port a8a4c364

R=yangguo@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1216863005

Cr-Commit-Position: refs/heads/master@{#29503}

R=ishell@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1212343007

Cr-Commit-Position: refs/heads/master@{#29502}

R=titzer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1218073008

Cr-Commit-Position: refs/heads/master@{#29501}

This implements the proper initialization of the new.target internal
variable in the AstGraphBuilder. For now this uses a runtime call that
cannot handle inlined frames correctly.

R=arv@chromium.org

Review URL: https://codereview.chromium.org/1212813008

Cr-Commit-Position: refs/heads/master@{#29500}

Previously, the serialization code would call Externalize for every transferred
ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If
the buffer is already externalized, we should call GetContents instead.

Also fix use-after-free bug when transferring ArrayBuffers. The transferred
ArrayBuffer must be internalized in the new isolate, or be managed by the
Shell. The current code gives it to the isolate externalized and frees it
immediately afterward when the SerializationData object is destroyed.

BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1215233004

Cr-Commit-Position: refs/heads/master@{#29499}

Review URL: https://codereview.chromium.org/1218783005

Cr-Commit-Position: refs/heads/master@{#29498}

Revert of Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1225793002/)

Reason for revert:
This will prevent rolls. Fixing the root issue instead.

Original issue's description:
> Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1195983002/)
>
> Reason for revert:
> Incorrect behavior
>
> Original issue's description:
> > [es6] Bound function names
> >
> > https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
> >
> > Bound functions should have a name based on the function that was
> > bound.
> >
> > This reverts the revert f2747ed9. The original
> > CL was reverted because the Blink layout test broke. I have a CL that disables
> > these tests at: https://codereview.chromium.org/1196753003/
> >
> > BUG=N
> > LOG=N
> > R=adamk
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/b6d950c979f4348138de0ec54e40dcc48d833926
> > Cr-Commit-Position: refs/heads/master@{#29193}
>
> TBR=adamk@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=N
>
> Committed: https://crrev.com/744e4d4fd9316674682bc6ca30ded5866494cc1c
> Cr-Commit-Position: refs/heads/master@{#29495}

TBR=adamk@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1222363002

Cr-Commit-Position: refs/heads/master@{#29497}

where bound functions' length was made configurable. The bootstrapper must be kept in sync to avoid polymorphism.

BUG=chromium:500686
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1221383003

Cr-Commit-Position: refs/heads/master@{#29496}

Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1195983002/)

Reason for revert:
Incorrect behavior

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> This reverts the revert f2747ed9. The original
> CL was reverted because the Blink layout test broke. I have a CL that disables
> these tests at: https://codereview.chromium.org/1196753003/
>
> BUG=N
> LOG=N
> R=adamk
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/b6d950c979f4348138de0ec54e40dcc48d833926
> Cr-Commit-Position: refs/heads/master@{#29193}

TBR=adamk@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1225793002

Cr-Commit-Position: refs/heads/master@{#29495}

Revert of Reland: Fix logic for incremental marking steps on tenured allocation (patchset #4 id:60001 of https://codereview.chromium.org/1077153004/)

Reason for revert:
[Sheriff] Speculative revert, see:
https://code.google.com/p/chromium/issues/detail?id=506875

Original issue's description:
> Reland: Fix logic for incremental marking steps on tenured allocation
>
> BUG=
>
> Committed: https://crrev.com/5000650bde2ec0bc90d959b529c97aea20385043
> Cr-Commit-Position: refs/heads/master@{#29442}

TBR=hpayer@chromium.org,erikcorry@chromium.org
BUG=chromium:506875
LOG=n
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1212063005

Cr-Commit-Position: refs/heads/master@{#29494}

Remove the context specialization hack from the AstGraphBuilder, and
properly specialize to the function context in the context specialization.
And replace the correct context in the JSInliner.

R=mstarzinger@chromium.org
BUG=v8:4273
LOG=n

Review URL: https://codereview.chromium.org/1218873005

Cr-Commit-Position: refs/heads/master@{#29493}

BUG=chromium:507213
LOG=n
NOTRY=true
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1213613005

Cr-Commit-Position: refs/heads/master@{#29492}

BUG=chromium:502176
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1217503008

Cr-Commit-Position: refs/heads/master@{#29491}

The value output count for Start is currently off by 1 for code stubs,
because the CommonOperatorBuilder hardcodes the receiver parameter.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1217553005

Cr-Commit-Position: refs/heads/master@{#29490}

BUG=v8:4254
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1226803002

Cr-Commit-Position: refs/heads/master@{#29489}