Jic and jialc compact branch ops are fixed as they does not have 'forbidden slot' restriction. Also COP1 branches (CTI instructions) added to IsForbiddenAfterBranchInstr().

TEST=cctest/test-disasm-mips/Type0
BUG=

Review URL: https://codereview.chromium.org/1423493006

Cr-Commit-Position: refs/heads/master@{#31922}

The minimum allocation limit already enforces this constraint for normal GCs.

GCs triggered by the memory reducer and external limit should work for all heap sizes.

BUG=chromium:552305
LOG=NO

Review URL: https://codereview.chromium.org/1418293006

Cr-Commit-Position: refs/heads/master@{#31921}

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1410883009

Cr-Commit-Position: refs/heads/master@{#31920}

Skips some more tests which started failing after https://codereview.chromium.org/1414183006 landed.

BUG=v8:4280
LOG=N
NOTRY=True

Review URL: https://codereview.chromium.org/1412343009

Cr-Commit-Position: refs/heads/master@{#31919}

Generated code performs distinct floating multiply and add/subtract
operations.  Tests fail when GCC uses fmadd/fmsub to calculate the
expected result since these instructions provide higher accuracy due
to the lack of an intermediate round.

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1416123007

Cr-Commit-Position: refs/heads/master@{#31918}

Review URL: https://codereview.chromium.org/1419793014

Cr-Commit-Position: refs/heads/master@{#31917}

This patch extends the typed lowering with a specialized version of 'instanceof' that is used if the "class", i.e. the constructor function, is a known constant.

Unittests check that replacement occurs as intended. Functional correctness is ensured by extensive unit tests covering instanceof already in the testsuite.

TESTS=unittests/JSTypedLoweringTest.{JSInstanceOfSpecializationWithSmiCheck,JSInstanceOfSpecializationWithoutSmiCheck,JSInstanceOfNoSpecialization}

Review URL: https://codereview.chromium.org/1407413014

Cr-Commit-Position: refs/heads/master@{#31916}

The body descriptor supports different visiting policies: it could visit or skip
the code entry and it could visit or skip next function field.

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1422773007

Cr-Commit-Position: refs/heads/master@{#31915}

Avoid write barriers when storing values in the root set, and use
cheaper write barriers for storing maps or tagged pointers. Also
improve the generated code for write barriers, utilizing the out
of line code mechanism that is available to TurboFan backends,
which moves the unlikely case out of the hot path.

R=jarin@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1414183006

Cr-Commit-Position: refs/heads/master@{#31914}

BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1413003008

Cr-Commit-Position: refs/heads/master@{#31913}

Ctz is implemented as an optional operator at the moment, which is only
implemented by x64 at the moment.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1421163005

Cr-Commit-Position: refs/heads/master@{#31912}

RegExp.prototye[@@split] is not yet implement to spec regarding creating
new RegExp object with the SpeciesConstructor.

R=littledan@chromium.org
BUG=v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1427573005

Cr-Commit-Position: refs/heads/master@{#31911}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1416093006

Cr-Commit-Position: refs/heads/master@{#31910}

  port 2b4cb2a1 (r31873)

  original commit message:
  The %StringCharFromCode and %CharFromCode runtime function perform
  exactly the same task, so we need only one of them.

BUG=

Review URL: https://codereview.chromium.org/1432063002

Cr-Commit-Position: refs/heads/master@{#31909}

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1405993009

Cr-Commit-Position: refs/heads/master@{#31908}

Reason for revert: failed tests on a Windows build.

TBR=rossberg,cbruni,neis
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1426943007

Cr-Commit-Position: refs/heads/master@{#31907}

Proxies are not properly supported yet.

R=cbruni, rossberg
BUG=

Review URL: https://codereview.chromium.org/1405243006

Cr-Commit-Position: refs/heads/master@{#31906}

Port 7c3396d0

Original commit message:
    Introduce receiver conversion mode specialization for the Call and
    CallFunction builtins, so we can specialize the builtin functionality
    (actually an optimization only) based on static information from the
    callsite (this is basically a superset of the optimizations that were
    available with the CallFunctionStub and CallICStub, except that these
    optimizations are correct now).

    This fixes a regression introduced by the removal of CallFunctionStub,
    for programs that call a lot.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:552244
LOG=n

Review URL: https://codereview.chromium.org/1425083004

Cr-Commit-Position: refs/heads/master@{#31905}

Port 2b4cb2a1

Original commit message:
    The %StringCharFromCode and %CharFromCode runtime function perform
    exactly the same task, so we need only one of them.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1429953005

Cr-Commit-Position: refs/heads/master@{#31904}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1433733002

Cr-Commit-Position: refs/heads/master@{#31903}

Port 4ab1b05d

Original commit message:
    Depends on https://codereview.chromium.org/1407373007/
    After that CL, all receiver conversion is handled by the call builtin.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1412803014

Cr-Commit-Position: refs/heads/master@{#31902}

Port 44c44521

Original commit message:
    This fixes receiver conversion since the Call builtin does it correctly.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4526
LOG=n

Review URL: https://codereview.chromium.org/1423973006

Cr-Commit-Position: refs/heads/master@{#31901}

BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1438463002

Cr-Commit-Position: refs/heads/master@{#31900}

Reduction Input:

    ChangeInt32ToFloat64=>          TruncateFloat64ToInt32
                         Float64Mul=>
    ChangeInt32ToFloat64=>          Float64Div=>TruncateFloat64ToInt32

Output:

         =>  TruncateInt64ToInt32
Int64Mul
         =>  Int64Shr => TruncateInt64ToInt32

Test code:

    function mul(a, b) {
      var l = a & 0x3ffffff;
      var h = b & 0x3ffffff;
      var m = l * h;

      var rl = m & 0x3ffffff;
      var rh = (m / 0x4000000) | 0;

      return rl | rh;
    }

    mul(1, 2);
    var a0 = mul(0x3ffffff, 0x3ffffff);
    mul(0x0, 0x0);
    %OptimizeFunctionOnNextCall(mul);
    var a1 = mul(0x3ffffff, 0x3ffffff);

    print(a0 + ' == ' + a1);

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1350223006

Cr-Commit-Position: refs/heads/master@{#31899}

Removed deprecated API usage in
 - test-heap.cc
 - test-incremental-marking.cc
 - test-alloc.cc

BUG=v8:4134
LOG=n

Review URL: https://codereview.chromium.org/1406393005

Cr-Commit-Position: refs/heads/master@{#31898}

This was found through a VC++ 2015 Update 1 warning about
pointer truncation. The fix is required for VC++ 2015
compatibility.

Review URL: https://codereview.chromium.org/1411403011

Cr-Commit-Position: refs/heads/master@{#31897}

I improved the tests for Word32Clz, Word32Ctz, and Word32Popcnt, and ported
some tests to the BufferedRawMachineAssemblerTester.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1437493002

Cr-Commit-Position: refs/heads/master@{#31896}

This unconditionally enables zapping of old optimized code maps and
unifies the various zapping paths. The unconditional zapping, even if
heap verification is off, is needed because slots in the code map have
not been recorded and evacuation invariants break.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1410833009

Cr-Commit-Position: refs/heads/master@{#31895}

BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1424263004

Cr-Commit-Position: refs/heads/master@{#31894}

This makes sure that --trace-turbo or --turbo-source-positions does not
completely disable inlining. The recent introduction of a finalization
interface to the reducer borked the SourcePositionWrapper reducer.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1406113008

Cr-Commit-Position: refs/heads/master@{#31893}

1) they always own descriptors,
2) the number of own descriptors is equal to the number of descriptors in the descriptor array.

This allows an initial map of a subclass to share descriptor array with initial map of the parent class (if it already contains properties).

BUG=chromium:551430
LOG=N

Review URL: https://codereview.chromium.org/1411933005

Cr-Commit-Position: refs/heads/master@{#31892}

Skips regress-446389.

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1412313010

Cr-Commit-Position: refs/heads/master@{#31891}

R=rossberg@chromium.org
BUG=chromium:552302
LOG=n

Review URL: https://codereview.chromium.org/1425723004

Cr-Commit-Position: refs/heads/master@{#31890}

BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1429423002

Cr-Commit-Position: refs/heads/master@{#31889}

This moves the clearing of all optimized code maps out of the GC and
into the debugger to where it is actually required. The main goal here
is to simplify the logic in the already complex visitor for our shared
function info objects.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1423713018

Cr-Commit-Position: refs/heads/master@{#31888}

BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1420203009

Cr-Commit-Position: refs/heads/master@{#31887}

BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1415143009

Cr-Commit-Position: refs/heads/master@{#31886}

This redcues the noise created by --trace-turbo-inlining when there
actually are no candidates being processed.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410723004

Cr-Commit-Position: refs/heads/master@{#31885}

  port 7c3396d0 (r31871)

  original commit message:
  Introduce receiver conversion mode specialization for the Call and
  CallFunction builtins, so we can specialize the builtin functionality
  (actually an optimization only) based on static information from the
  callsite (this is basically a superset of the optimizations that were
  available with the CallFunctionStub and CallICStub, except that these
  optimizations are correct now).

  This fixes a regression introduced by the removal of CallFunctionStub,
  for programs that call a lot.

BUG=

Review URL: https://codereview.chromium.org/1431133002

Cr-Commit-Position: refs/heads/master@{#31884}

BUG=

Review URL: https://codereview.chromium.org/1429063003

Cr-Commit-Position: refs/heads/master@{#31883}