This is a first step towards merging FeedbackVectorSlot and FeedbackVectorICSlot.

Review URL: https://codereview.chromium.org/1369973002

Cr-Commit-Position: refs/heads/master@{#30964}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1365803004

Cr-Commit-Position: refs/heads/master@{#30963}

Review URL: https://codereview.chromium.org/1367423002

Cr-Commit-Position: refs/heads/master@{#30962}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1366183003

Cr-Commit-Position: refs/heads/master@{#30961}

Fails since test262-es6 is tested without i18n support.

BUG=v8:4437
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1368293002

Cr-Commit-Position: refs/heads/master@{#30960}

The change https://codereview.chromium.org/1274453002 is causing a breakage
on the Chrome OS builds. It is not clear how to easily revert because there is
a following on dependent change (https://codereview.chromium.org/1351983002) am
I am not too familiar with the revert process.

The simplest revert is to remove the DCHECK.

BUG=chromium:536163
LOG=n
NOTRY=true
R=machenbach@chromium.org, cmumford@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1372693002 .

Cr-Commit-Position: refs/heads/master@{#30959}

Review URL: https://codereview.chromium.org/1361893006

Cr-Commit-Position: refs/heads/master@{#30958}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1365503005

Cr-Commit-Position: refs/heads/master@{#30957}

The internal ConvertToString helper was using the wrong ToPrimitive,
actually the old ES5 like DefaultString, and it also prematurely
optimized for no real benefit.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1370943002

Cr-Commit-Position: refs/heads/master@{#30956}

Also support %_ToString in Crankshaft utilizing the ToStringStub, which
is also used in TurboFan and fullcodegen. This is necessary to repair a
regression on Octane that was introduced when switching from the hand
crafted NonStringToString/ToString magic to %_ToString (which properly
supports @@toPrimitive).

BUG=chromium:535953,v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1373743002

Cr-Commit-Position: refs/heads/master@{#30955}

port c90c60ba (r30940)

original commit message:

    Make sure to always reference it indirectly. This allows us to make the vector
    native-context dependent should we wish.

BUG=

Review URL: https://codereview.chromium.org/1369963002

Cr-Commit-Position: refs/heads/master@{#30954}

Rolling v8/buildtools to 8d89c1b15f80323b54b3305b2be7b26686fd5611

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1368213002

Cr-Commit-Position: refs/heads/master@{#30953}

Fails since test262-es6 is tested without i18n support.

BUG=v8:4437
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1369113002

Cr-Commit-Position: refs/heads/master@{#30952}

Rolling v8/third_party/icu to 423fc7e1107fb08ccf007c4aeb76dcab8b2747c1

Rolling v8/tools/clang to 290301c180118e27755bfced176ff61bd0acb1b8

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1373683002

Cr-Commit-Position: refs/heads/master@{#30951}

Revert of JSObject::GetEnumProperty cleanup (patchset #2 id:20001 of https://codereview.chromium.org/1363293002/ )

Reason for revert:
Reverting, because of broken GC stress bots.

@cbruni: Sorry for the revert. I'm not entirely sure it's actually your CL; but policy is to revert speculatively if we can't determine an exact cause.

Original issue's description:
> JSObject::GetEnumProperty cleanup
>
> BUG=
>
> Committed: https://crrev.com/a00d47c802f93cf9835eafce4c9da2dd10b44f6a
> Cr-Commit-Position: refs/heads/master@{#30946}

TBR=jkummerow@chromium.org,cbruni@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1371673004

Cr-Commit-Position: refs/heads/master@{#30950}

BUG=

Review URL: https://codereview.chromium.org/1372623002

Cr-Commit-Position: refs/heads/master@{#30949}

Revert of [heap] Move large object space selection into AllocateRaw. (patchset #2 id:20001 of https://codereview.chromium.org/1373523002/ )

Reason for revert:
Breaks mac asan:
http://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/2895

According to auto bisect

Original issue's description:
> [heap] Move large object space selection into AllocateRaw.
>
> BUG=
>
> Committed: https://crrev.com/e4f7ebb000432cc2011ecaaa71a69e2e60f416f0
> Cr-Commit-Position: refs/heads/master@{#30938}

TBR=mlippautz@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1368833004

Cr-Commit-Position: refs/heads/master@{#30948}

Revert of "[heap] Add more tasks for parallel compaction" (patchset #4 id:100001 of https://codereview.chromium.org/1365743003/ )

Reason for revert:
failing again: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac/builds/4505/steps/Mozilla%20%28flakes%29/logs/regress-416628

Original issue's description:
> Reland of "[heap] Add more tasks for parallel compaction"
>
> - We now compute the number of parallel compaction tasks, depending on the
>   evacuation candidate list, the number of cores, and some hard limit.
> - Free memory is moved over to compaction tasks (up to some limit)
> - Moving over memory is done by dividing the free list of a given space up among
>   other free lists. Since this is potentially slow we limit the maximum amount
>   of moved memory.
>
> This reverts commit bfccd518.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/7e283d746a194ceaaca114e2ba17504653d6a109
> Cr-Commit-Position: refs/heads/master@{#30945}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1371653002

Cr-Commit-Position: refs/heads/master@{#30947}

BUG=

Review URL: https://codereview.chromium.org/1363293002

Cr-Commit-Position: refs/heads/master@{#30946}

- We now compute the number of parallel compaction tasks, depending on the
  evacuation candidate list, the number of cores, and some hard limit.
- Free memory is moved over to compaction tasks (up to some limit)
- Moving over memory is done by dividing the free list of a given space up among
  other free lists. Since this is potentially slow we limit the maximum amount
  of moved memory.

This reverts commit bfccd518.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1365743003

Cr-Commit-Position: refs/heads/master@{#30945}

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1352453004

Cr-Commit-Position: refs/heads/master@{#30944}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1361953003

Cr-Commit-Position: refs/heads/master@{#30943}

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1366173002

Cr-Commit-Position: refs/heads/master@{#30942}

Review URL: https://codereview.chromium.org/1359033002

Cr-Commit-Position: refs/heads/master@{#30941}

Make sure to always reference it indirectly. This allows us to make the vector
native-context dependent should we wish.

R=ishell@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1364373003

Cr-Commit-Position: refs/heads/master@{#30940}

This prevents the internal gc-idle-time-handler.h to be usable outisde
of the "heap" directory. The logic inside that component is only useful
within the GC and is now properly encapsulated.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1368983002

Cr-Commit-Position: refs/heads/master@{#30939}

BUG=

Review URL: https://codereview.chromium.org/1373523002

Cr-Commit-Position: refs/heads/master@{#30938}

Looks like we never ran test262-es6 on mac. After merging
into test262 we've got these failures. Skipping for now.

BUG=v8:4437
LOG=n
NOTRY=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1372603002

Cr-Commit-Position: refs/heads/master@{#30937}

BUG=v8:4254
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1365293002

Cr-Commit-Position: refs/heads/master@{#30936}

Review URL: https://codereview.chromium.org/1372533002

Cr-Commit-Position: refs/heads/master@{#30935}

This name makes it clear that the flag (also the variant in the Compiler)
is talking about specializing to the function context instead of i.e. the
native context.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1372513003

Cr-Commit-Position: refs/heads/master@{#30934}

This enables linter checking for "runtime/threadsafe_fn" violations
during presubmit and instead marks the few known exceptions that we
allow explicitly.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1369673003

Cr-Commit-Position: refs/heads/master@{#30933}

This is from
https://chromium.googlesource.com/v8/v8/+/347fa90626a448e3535cf6aa100124dfd5b711ce

BUG=

Review URL: https://codereview.chromium.org/1365113003

Cr-Commit-Position: refs/heads/master@{#30932}

Revert of [heap] Move large object space selection into AllocateRaw. (patchset #1 id:1 of https://codereview.chromium.org/1360903004/ )

Reason for revert:
[Sheriff] Breaks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2080

And maybe (not sure):
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/1529

Original issue's description:
> [heap] Move large object space selection into AllocateRaw.
>
> BUG=
>
> Committed: https://crrev.com/1403815bdbcbd3336b2d85291704640fada30ffe
> Cr-Commit-Position: refs/heads/master@{#30930}

TBR=mlippautz@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1368103002

Cr-Commit-Position: refs/heads/master@{#30931}

BUG=

Review URL: https://codereview.chromium.org/1360903004

Cr-Commit-Position: refs/heads/master@{#30930}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1370663002

Cr-Commit-Position: refs/heads/master@{#30929}

Not resetting the allocation area after freeing it potentially results in
negative SizeOfObjects() because the area is accounted for as allocated while it
has already been freed.

BUG=

Review URL: https://codereview.chromium.org/1364303002

Cr-Commit-Position: refs/heads/master@{#30928}

Verifies consistency of node inputs and uses:
- node inputs should agree with the input count computed from the node's operator.
- effect inputs should have effect outputs (or be a sentinel).
- control inputs should have control outputs (or be a sentinel).
- frame state inputs should be frame states (or be a sentinel).
- if the node has control uses, it should produce control.
- if the node has effect uses, it should produce effect.
- if the node has frame state uses, it must be a frame state.

I also removed some tests, either because they did not seem to be useful (scheduler) or they tested dead functionality (diamond effect phi).

Review URL: https://codereview.chromium.org/1368913002

Cr-Commit-Position: refs/heads/master@{#30927}

mdb_v8, a post-mortem debugger for Node.js, now uses JSArrayBuffer's
backing_store property and JSArrayBufferView's byte_offset property to
get access to the content of Buffer instances in node (which are
Uint8Array instances). This change adds post-mortem metadata for these
two properties.

This change also fixes a typo in
inobject_properties_of_constructor_function_index_offset that was added
to gen-postmortem-metadata in a previous change. It should be named
inobject_properties_or_constructor_function_index instead.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1363403003

Cr-Commit-Position: refs/heads/master@{#30926}

The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod.  This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.

The original removal of Function.prototype.toMethod was in February
2015 in 68e48975.

R=jarin@chromium.org
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1366063002

Cr-Commit-Position: refs/heads/master@{#30925}