A concurrent sweeper thread can access the same markbit cell as the main thread
during right trimming a fixed array, resulting in a data race on a markbit cell.
Previously we checked whether we were currently marking incrementally, filtering
out this case.

The current check has the benefit of keeping live_bytes accurate (modulo other
bugs) until the sweeper starts.

BUG=chromium:576193
LOG=N

Review URL: https://codereview.chromium.org/1576853002

Cr-Commit-Position: refs/heads/master@{#33203}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1578723002

Cr-Commit-Position: refs/heads/master@{#33202}

Escape analysis will eliminate the context, if possible. Materialization
must then ensure that the materialized object has the right map, and that
the context register is set accordingly.

R=jarin@chromium.org
BUG=569530,v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1572293002

Cr-Commit-Position: refs/heads/master@{#33201}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1565153002

Cr-Commit-Position: refs/heads/master@{#33200}

Until now we've been allowing unmarked asm code
through the typer. Start rejecting it.

Adding a cctest that asm modules missing an export return
fail validation.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1569423002

Cr-Commit-Position: refs/heads/master@{#33199}

In particular, Claim doesn't work with a negative size, so ensure that
it is positive.

BUG=

Review URL: https://codereview.chromium.org/1565193002

Cr-Commit-Position: refs/heads/master@{#33198}

Get the BE bots green in the short term.

BUG=

Review URL: https://codereview.chromium.org/1571243002

Cr-Commit-Position: refs/heads/master@{#33197}

  port fc5c7e04 (r33172)

  original commit message:
  There's no reason to have JavaScript wrappers for those accessors,
  since the meat is already in hand-written native code (via %_DateField).
  First step now to put them into native builtins. Next step will be to
  completely remove %_DateField.

BUG=

Review URL: https://codereview.chromium.org/1576813003

Cr-Commit-Position: refs/heads/master@{#33196}

Rolling v8/tools/clang to 0e2c562e4ee6e1a4a2f35b1bd60b2e208cd00838

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1572713003

Cr-Commit-Position: refs/heads/master@{#33195}

Removed unused name_ field, made bitfield 16-bits long, and moved it to
the start of the struct, resulting in a reduction of 8 bytes on both
32 and 64-bit platforms.

Most other changes (which prompted this work) are cosmetic:r
  - Combined redundant enums
  - Named enum values kConsistently
  - Consistently use booleans in bitfield, using enum values
    only for passing information into NewFunctionLiteral
  - Removed unneeded arguments from NewFunctionLiteral, reducing
    clutter at callsites
  - Added const correctness consistently

Review URL: https://codereview.chromium.org/1566053002

Cr-Commit-Position: refs/heads/master@{#33194}

This at least puts something in the tree demonstrating the breakage;
it can be moved into regress/ if we fix it.

R=littledan@chromium.org
BUG=v8:4577
LOG=n

Review URL: https://codereview.chromium.org/1576503002

Cr-Commit-Position: refs/heads/master@{#33193}

Originally, only BindingIdentifiers were a legal operand for the `...` ellipsis
in a function rest parameter. This has since changed, allowing the rest array
to be destructured.

The grammar is now the following:

```
FunctionRestParameter[Yield]:
    BindingRestElement[?Yield]

BindingRestElement[Yield]:
    ... BindingIdentifier[?Yield]
    ... BindingPattern[?Yield]
```

*Spec change: https://github.com/tc39/ecma262/commit/d322357e6be95bc4bd3e03f5944a736aac55fa50
*TC39 Discussion: https://github.com/tc39/tc39-notes/blob/master/es7/2015-07/july-28.md#66-bindingrestelement-should-allow-a-bindingpattern-ala-assignmentrestelement

BUG=v8:4627, v8:2159
LOG=N
R=littledan@chromium.org, adamk@chromium.org, wingo@igalia.com, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1532873004

Cr-Commit-Position: refs/heads/master@{#33192}

Port fc5c7e04

Original commit message:
There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

BUG=
TEST=test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-10, test262/built-ins/Date/prototype/toISOString/15.9.5.43-0-11, test262/built-ins/Date/S15.9.3.1_A5_T1

Review URL: https://codereview.chromium.org/1569353002

Cr-Commit-Position: refs/heads/master@{#33191}

Encode "parenthesized" status of parenthesized Expressions to prevent
them from being treated as Patterns.

BUG=v8:4657, v8:811
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1570793002

Cr-Commit-Position: refs/heads/master@{#33190}

Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #1 id:1 of https://codereview.chromium.org/1565263002/ )

Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}

Fixed a bug in VisitForInAssignment. After visiting the object the value
to be stored was not loaded back to the accumulator. Also added two tests
to check this case.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1571753002

Cr-Commit-Position: refs/heads/master@{#33188}

Port fc5c7e04

Original commit message:
    There's no reason to have JavaScript wrappers for those accessors,
    since the meat is already in hand-written native code (via %_DateField).
    First step now to put them into native builtins. Next step will be to
    completely remove %_DateField.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1569173003

Cr-Commit-Position: refs/heads/master@{#33187}

Adds support for the CallRuntimeForPair bytecode to the Bytecode Graph
Builder. Modifies the FrameState support to allow updating of output
registers.

Also adds Eval tests to test-run-bytecode-graph-builder since these are
enabled by CallRuntimeForPair support.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1570623007

Cr-Commit-Position: refs/heads/master@{#33186}

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816

Review URL: https://codereview.chromium.org/1564923007

Cr-Commit-Position: refs/heads/master@{#33185}

Adds support for calling eval to the interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1508293003

Cr-Commit-Position: refs/heads/master@{#33184}

This patch introduces a mechanism for changing the scope of temporary
variables, which is necessary for rewriting arrow parameter
initializers.

It also fixes a potential bug in AstExpressionVisitor, which did not
visit the automatically generated members of ForEachStatement.

Fixes test/mjsunit/harmony/regress/regress-4658.js

R=rossberg@chromium.org
BUG=v8:4658
LOG=N

Review URL: https://codereview.chromium.org/1564343002

Cr-Commit-Position: refs/heads/master@{#33183}

Matches https://crrev.com/366832

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1551453002

Cr-Commit-Position: refs/heads/master@{#33182}

Adds support for calling runtime functions which return a pair of
values. Adds the bytecode CallRuntimePair. Also adds support to TurboFan
for calling stubs which return multiple values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568493002

Cr-Commit-Position: refs/heads/master@{#33181}

R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1543553002

Cr-Commit-Position: refs/heads/master@{#33180}

BUG=chromium:574953
LOG=n

Review URL: https://codereview.chromium.org/1570443004

Cr-Commit-Position: refs/heads/master@{#33179}

It's sufficient to check for --harmony-unicode-regexps when parsing the
regexp flags from string.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1567413002

Cr-Commit-Position: refs/heads/master@{#33178}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1567393003

Cr-Commit-Position: refs/heads/master@{#33177}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1568293002

Cr-Commit-Position: refs/heads/master@{#33176}

R=mstarzinger@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575364

Review URL: https://codereview.chromium.org/1564313003

Cr-Commit-Position: refs/heads/master@{#33175}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1569223002

Cr-Commit-Position: refs/heads/master@{#33174}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571713002

Cr-Commit-Position: refs/heads/master@{#33173}

There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567353002

Cr-Commit-Position: refs/heads/master@{#33172}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571703002

Cr-Commit-Position: refs/heads/master@{#33171}

* Buffer counter updates in the corresponding visitor to allow parallel
  processing of pages.
* Fix a bug where we don't keep live bytes in sync when marking is already
  finished.

LOG=N
BUG=524425

Review URL: https://codereview.chromium.org/1559873004

Cr-Commit-Position: refs/heads/master@{#33170}

R=rossberg@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1565183002

Cr-Commit-Position: refs/heads/master@{#33169}

LOG=N
BUG=v8:4606
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1572513002

Cr-Commit-Position: refs/heads/master@{#33168}

Everything necessary to implement Object.keys efficiently is already
available in C++ land for quite some time now, and only the thin
JavaScript wrapper was left, so get rid of that as well and move the
whole builtin to C++ instead.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567963002

Cr-Commit-Position: refs/heads/master@{#33167}

  The original kX87BitcastFI and kX87BitcastIF of x87 code generation in TurboFan have bugs and caused all Run_Wasm_F32CopySign test cases failed.

  This CL will fix them.

BUG=

Review URL: https://codereview.chromium.org/1565183003

Cr-Commit-Position: refs/heads/master@{#33166}

Requesting reservation of a wasm section for experimentation with
storing source code meta information, such as source code comments,
and also extra inform on presentation of the AST such an `if-block`
pattern being presented as a `when` operation.

The wasm design already defines unrecognized sections to be ignored,
and this reserved section is ignored. This section is only intended to
hold source code meta information and to have no effect on code
execution.

With wasm going live (behind a flag) on v8, I would also like to be
able to give people something to play with in terms of the deployed
binary code being a useful source code. It's all experimental, but I
understand the entire binary format that V8 is currently using is
basically a throwaway, and that the working strategy is to get
something running and then revisit format decisions.

I would like a fixed reserved section number to avoid potential
clashes with other projects - although I am not aware of any other
calls for addition sections beyond the need for debug info. If a fixed
number is not acceptable, then could this patch alternatively ignore
all unrecognized sections and perhaps add the section size to them
all - something which is already noted todo in the design document?

BUG=

Review URL: https://codereview.chromium.org/1565693002

Cr-Commit-Position: refs/heads/master@{#33165}

Fixes a number of test262 tests, including:

- built-ins/Promise/reject-function-nonconstructor.js
- built-ins/Promise/resolve-function-nonconstructor.js
- built-ins/Promise/all/resolve-element-function-nonconstructor.js
- built-ins/Promise/executor-function-nonconstructor.js

BUG=v8:4633
LOG=N
R=adamk@chromium.org, cbruni@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1565303004

Cr-Commit-Position: refs/heads/master@{#33164}