Rolling v8/build/gyp to 133eaf70b3720b7413017ef3f9c42f6811ef9347

Rolling v8/third_party/icu to 0d572d65aae621e13d6863fe470c9c8cee71043d

This is the same as the auto-generated version, but with a
landmine: https://codereview.chromium.org/1824563002/

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Committed: https://crrev.com/1d6dba43c2b61900be68777297634e05d479a25a
Cr-Commit-Position: refs/heads/master@{#34914}

patch from issue 1824563002 at patchset 1 (http://crrev.com/1824563002#ps1)

BUG=

Review URL: https://codereview.chromium.org/1820823002

Cr-Commit-Position: refs/heads/master@{#34921}

In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
Cr-Commit-Position: refs/heads/master@{#34830}

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34920}

I first need to figure out what to do about window.document before we
can deprecate this: window.document is a regular accessor, however, once
the window navigated from about:blank, its value will never change.
Blink uses ForceSet to then replace the accessor with a data constant
which has way better performance than invoking the accessor all the
time.

Since the accessor, however, is installed as read only &
non-configurable, there is no spec compliant way to pull this off right
now

BUG=chromium:595601
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1816033002

Cr-Commit-Position: refs/heads/master@{#34919}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1819793002

Cr-Commit-Position: refs/heads/master@{#34918}

Review URL: https://codereview.chromium.org/1799023003

Cr-Commit-Position: refs/heads/master@{#34917}

Up until now all type conversions (i.e. ToNumber, ToString and friends)
had their own specific call interface descriptors, where some of them
had to match (i.e. ToString and NumberToString have to use the same
argument register). Instead of all the different descriptors, it's
sufficient to have a single TypeConversionDescriptor instead.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1823523002

Cr-Commit-Position: refs/heads/master@{#34916}

Reason for revert:
ICU breakage.

Original issue's description:
> Update V8 DEPS.
>
> Rolling v8/build/gyp to 133eaf70b3720b7413017ef3f9c42f6811ef9347
>
> Rolling v8/third_party/icu to 0d572d65aae621e13d6863fe470c9c8cee71043d
>
> TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
>
> Committed: https://crrev.com/1d6dba43c2b61900be68777297634e05d479a25a
> Cr-Commit-Position: refs/heads/master@{#34914}

TBR=hablich@chromium.org,machenbach@chromium.org,vogelheim@chromium.org,v8-autoroll@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1816023002

Cr-Commit-Position: refs/heads/master@{#34915}

Rolling v8/build/gyp to 133eaf70b3720b7413017ef3f9c42f6811ef9347

Rolling v8/third_party/icu to 0d572d65aae621e13d6863fe470c9c8cee71043d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1824563002

Cr-Commit-Position: refs/heads/master@{#34914}

Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG=chromium:595738, chromium:535408
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}

BUG=

Review URL: https://codereview.chromium.org/1823463002

Cr-Commit-Position: refs/heads/master@{#34912}

Rolling v8/tools/clang to a00149535c011c08b6e8cc583a1f10f38d3cdaf9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1817713002

Cr-Commit-Position: refs/heads/master@{#34911}

This revealed one Mozilla test that depended upon a lack
of early error for "with ({}) function ...". The test
has been marked as failing.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1814863005

Cr-Commit-Position: refs/heads/master@{#34910}

BUG=chromium:594974
LOG=N

Review URL: https://codereview.chromium.org/1801313002

Cr-Commit-Position: refs/heads/master@{#34909}

  - Move default parameters tests from harmony/ to es6/ and remove
    non-existent --harmony-default-parameters flag.
  - Remove some non-existent tests from mjsunit.status

Review URL: https://codereview.chromium.org/1812313002

Cr-Commit-Position: refs/heads/master@{#34908}

Dropping newlines in the test macros used in test-asm-validator.
This will make the tests number from 1, rather than 39,
making them easier to read.

LOG=N
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org

Review URL: https://codereview.chromium.org/1812383002

Cr-Commit-Position: refs/heads/master@{#34907}

Revert of Restore per-TypedArray-class length accessors as a perf workaround (patchset #2 id:20001 of https://codereview.chromium.org/1624383003/ )

Reason for revert:
This patch actually seemed to cause a further GameBoy regression! Reverting it seems to address the regression.

Original issue's description:
> Restore per-TypedArray-class length accessors as a perf workaround
>
> This patch is a workaround to the performance regression caused by
> implementing the ES2015 TypedArray prototype chain: Include a
> per-TypedArray-subclass length getter so that the superclass getter does
> not become polymorphic. The patch appears to fix a regression in the
> Gameboy Octane benchmark.
>
> BUG=chromium:579905
> R=adamk
> LOG=Y
>
> Committed: https://crrev.com/03ce7711e474a0ef74f723b30ae1527c89dec010
> Cr-Commit-Position: refs/heads/master@{#33501}

R=adamk@chromium.org
BUG=chromium:579905,chromium:593634
LOG=Y

Review URL: https://codereview.chromium.org/1812143004

Cr-Commit-Position: refs/heads/master@{#34906}

Revert of Inline fast-path interceptor access in the IC utilities (patchset #2 id:20001 of https://codereview.chromium.org/1810083003/ )

Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5506

Original issue's description:
> Inline fast-path interceptor access in the IC utilities
>
> BUG=
>
> Committed: https://crrev.com/b3bda50ddd9e30b718ae7972d9dd0d095113f634
> Cr-Commit-Position: refs/heads/master@{#34892}

TBR=jkummerow@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1819433003

Cr-Commit-Position: refs/heads/master@{#34905}

API change: This adds a new flag skip_html_comments to v8::ScriptOriginOptions. This flag controls whether V8 will attempt to honour HTML-style comments in JS sources.

(That is: Gracefully ignore <!-- ... ---> in JS sources, which was a popular technique in the early days of JavaScript, to prevent non-JS-enabled browsers from displaying script sources to uses.)

The flag defaults to 'true' when using v8::ScriptOrigin constructor, which preserves the existing behaviour. Embedders which are happy with the existing behaviour will thus not need any changes.

BUG=chromium:573887
LOG=Y

Review URL: https://codereview.chromium.org/1801203002

Cr-Commit-Position: refs/heads/master@{#34904}

There are multiple ways we may construct an instruction sequence.
Moved the split edge form validation where they must all eventually
chokepoint to - the register allocation pipeline, which is also the main
and first consumer of this property.

BUG=

Review URL: https://codereview.chromium.org/1810293003

Cr-Commit-Position: refs/heads/master@{#34903}

This removes the Isolate argument from the IsLiteralCompareUndefined
predicate as it is no longer required to determine the answer.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1814823005

Cr-Commit-Position: refs/heads/master@{#34902}

Just sayin'.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1813913004

Cr-Commit-Position: refs/heads/master@{#34901}

This moves the call-sites that ensure we have a feedback vector present
before kicking off a compiler into the actual compilation pipeline. The
backends no longer need to worry about the feedback vector.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1811973006

Cr-Commit-Position: refs/heads/master@{#34900}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1811323002

Cr-Commit-Position: refs/heads/master@{#34899}

Since we clear invalid slots eagerly, there is no need to check if a slot is a valid slot.

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1817523002

Cr-Commit-Position: refs/heads/master@{#34898}

BUG=

Review URL: https://codereview.chromium.org/1813923002

Cr-Commit-Position: refs/heads/master@{#34897}

This is an experiment to see if it affects crash rates on Nexus 9 devices.
A small performance impact (3-4% on Octane) is expected.

BUG=chromium:524337
LOG=n
R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1808243002

Cr-Commit-Position: refs/heads/master@{#34896}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1816463002

Cr-Commit-Position: refs/heads/master@{#34895}

R=jkummerow@chromium.org
BUG=chromium:595657
LOG=N

Review URL: https://codereview.chromium.org/1811913006

Cr-Commit-Position: refs/heads/master@{#34894}

BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}

BUG=

Review URL: https://codereview.chromium.org/1810083003

Cr-Commit-Position: refs/heads/master@{#34892}

This is a pure refactoring CL and should not contain any functional
changes to the code. The following has been done:
- Group compiler.cc into sections for each component.
- Surround local helper methods by anonymous namespace.
- Move implementation of Compiler (API class) together.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1809403002

Cr-Commit-Position: refs/heads/master@{#34891}

Implements Stage 4 proposal from http://rwaldron.github.io/exponentiation-operator/,
without adding any knowledge of the feature to compiler backends.

BUG=v8:3915
LOG=Y
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1678303002

Cr-Commit-Position: refs/heads/master@{#34890}

The higher word (bits 32 - 63) of FPU register is set on zero before
storing result.

TEST=cctest/test-macro-assembler-mips64/Cvt_s_uw_Trunc_uw_s
BUG=

Review URL: https://codereview.chromium.org/1812193003

Cr-Commit-Position: refs/heads/master@{#34889}

Using std::sort on a FixedArray with HeapNumbers is not very GC friendly.
Adding a separate step to properly record possible HeapNumbers.

BUG=chromium:594954
LOG=N

Review URL: https://codereview.chromium.org/1807173002

Cr-Commit-Position: refs/heads/master@{#34888}

The trigger point in question is by now obsolete. The optimized compile
job will itself ensure that deoptimization support is present on the
incoming SharedFunctionInfo, this will make sure to produce baseline
code when necessary. The ScopeInfo is also installed at that point in
time.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1816513002

Cr-Commit-Position: refs/heads/master@{#34887}

Adjust the status file after https://codereview.chromium.org/1784343004

Also removed the tests that are not failing anymore on big-endian.

BUG=

Review URL: https://codereview.chromium.org/1814833003

Cr-Commit-Position: refs/heads/master@{#34886}

This changes the compilation pipeline so that SharedFunctionInfo objects
are always allocated before the various compilers are invoked. It is a
preparation towards having that object available during compile time and
hence reducing the dependency on FunctionLiteral and the need to copy a
lot of the information into the CompilationInfo.

Optimizing compilers already assume the SharedFunctionInfo is present
and the baseline compilers have other heap accesses sprinkled throughout
the compilation process. Duplicating statically available information
from the SharedFunctionInfo within the CompilationInfo has no benefit.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1813803002

Cr-Commit-Position: refs/heads/master@{#34885}

Port 515105a7

Exact simulation of bovc and bnvc instructions.

BUG=

Review URL: https://codereview.chromium.org/1785923011

Cr-Commit-Position: refs/heads/master@{#34884}

We need one message in case the function is not an object, and
another if it was an object but not callable.

R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1814823002

Cr-Commit-Position: refs/heads/master@{#34883}

BUG=chromium:568949
LOG=n
TBR=kjellander@chromium.org, tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1814153002

Cr-Commit-Position: refs/heads/master@{#34882}