We need to build parts of v8 with a toolchain that might be different
from both the default (target) toolchain and the regular host toolchain,
because we need the snapshot to have the same bit-width as the target.
V8's build defines a 'snapshot_toolchain' setting for this.

It turns out that we need the value of this toolchain to be exposed
to the Chromium build because some of the test targets (in browser_tests)
depend on d8 and need to be able to built using the same toolchain.

R=brett@chromium.org, jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1350223004

Cr-Commit-Position: refs/heads/master@{#30854}

Turn on some test262 tests that pass now.

R=adamk
LOG=Y
BUG=v8:4285

Review URL: https://codereview.chromium.org/1357233002

Cr-Commit-Position: refs/heads/master@{#30853}

Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.

For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1355113002

Cr-Commit-Position: refs/heads/master@{#30852}

Cr-Commit-Position: refs/heads/master@{#30851}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1360553003

Cr-Commit-Position: refs/heads/master@{#30850}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1356913002

Cr-Commit-Position: refs/heads/master@{#30849}

BUG=

Review URL: https://codereview.chromium.org/1345273004

Cr-Commit-Position: refs/heads/master@{#30848}

This doesn't fix the performance regression mentioned by the bug yet,
but is necessary cleanup to land the fix, and should be separated from
the actual fix.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1345313005

Cr-Commit-Position: refs/heads/master@{#30847}

Removes deprecated functions from the following files:

test/cctest/compiler/function-tester.h
test/cctest/test-thread-termination.cc
test/cctest/test-threads.cc
test/cctest/test-transitions.cc
test/cctest/test-typedarrays.cc
test/cctest/test-types.cc
test/cctest/test-typing-reset.cc
test/cctest/test-unbound-queue.cc
test/cctest/test-unboxed-doubles.cc

BUG=v8:4134
LOG=n

Review URL: https://codereview.chromium.org/1344583002

Cr-Commit-Position: refs/heads/master@{#30846}

port 8016547c (r30818).

original commit message:

    The StringCompareStub used to take its parameters on the (JavaScript)
    stack, which made it impossible to use in TurboFan. Actually
    StringCompareStub was currently completely unused. This changes the
    calling convention to something TurboFan compatible and introduces a
    CallInterfaceDescriptor for StringCompareStub. It also changes
    HStringCompareAndBranch to use the StringCompareStub instead of using
    the full blown CompareICStub for a stupid string comparison.

BUG=

Review URL: https://codereview.chromium.org/1355983003

Cr-Commit-Position: refs/heads/master@{#30845}

port 593c655a (r30816).

original commit message:

    This removes the weird COMPARE and COMPARE_STRONG JavaScript builtins
    and replaces them with a proper C++ implementation in Object::Compare
    and appropriate wrappers Object::LessThan, Object::GreaterThan, and
    friends that are intended to be used by a true/false returning CompareIC
    in the future, as well as the interpreter.  As a short-term solution we
    provide %Compare and %Compare_Strong entry points for the current
    CompareIC that return the appropriate integer values expected by
    fullcodegen currently.

    Now the Abstract Relational Comparison is also using the correct
    ToPrimitive implementation, which properly supports @@toPrimitive.

BUG=

Review URL: https://codereview.chromium.org/1353343002

Cr-Commit-Position: refs/heads/master@{#30844}

mdb_v8, a post-mortem debugging tool for Node.js, allows users to
inspect ScopeInfo structures in order to get more information about
closures.

Currently, it hardcodes the metadata it uses to find this information.
This change allows it to get this metadata from the node binary itself,
and thus to adapt to future changes made to the layout of the ScopeInfo
data structure.

BUG=

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1350843003

Cr-Commit-Position: refs/heads/master@{#30843}

ES2015 specifies very particular semantics for functions defined in blocks.
In strict mode, it is simply a lexical binding scoped to that block. In sloppy
mode, in addition to that lexical binding, there is a var-style binding in
the outer scope, which is overwritten with the local binding when the function
declaration is evaluated, *as long as* introducing ths var binding would not
create a var/let conflict in the outer scope.

This patch implements the semantics by introducing a DelegateStatement, which
is initially filled in with the EmptyStatement and overwritten with the
assignment when the scope is closed out and it can be checked that there is
no conflict.

This patch is tested with a new mjsunit test, and I tried staging it and running
test262, finding that the tests that we have disabled due to lack of Annex B
support now pass.

R=adamk,rossberg
LOG=Y
BUG=v8:4285

Review URL: https://codereview.chromium.org/1332873003

Cr-Commit-Position: refs/heads/master@{#30842}

Upon collection of the stack trace if the current PC falls into
the frame building code, the top frame might be in a non-consistent
state. That leads to some of the frames could be missing from the
stack trace.

The patch makes it check instructions under current PC and if they
look like the frame setup/destroy code, it skips the entire sample.

Support for x86/x64

CG_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_msan_rel
BUG=chromium:529931
LOG=N

Review URL: https://codereview.chromium.org/1348533005

Cr-Commit-Position: refs/heads/master@{#30841}

Rolling v8/build/gyp to cf3170e30578d600b8ec8cd68553cc5e606d42eb

Rolling v8/tools/clang to 76e743dc622478312b66661ad48997b318628cbb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1357793002

Cr-Commit-Position: refs/heads/master@{#30840}

Since https://codereview.chromium.org/272163002, BitField3 is a raw
uint32 field, and not a SMI anymore.

Update tools/gen-postmortem-metadata.py so that post-mortem tools can
work with versions of V8 that shipped after that change.

This change was merged in github.com/joyent/node right before node
v0.12.0 was released.

R=danno@chromium.org

TEST=mdb_v8, a post-mortem debugging tool running on SmartOS,  has been
using this change since Node.js v0.12.0 was released

BUG=

Review URL: https://codereview.chromium.org/1296743003

Cr-Commit-Position: refs/heads/master@{#30839}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1345223005

Cr-Commit-Position: refs/heads/master@{#30838}

Port 8016547c

Original commit message:
    The StringCompareStub used to take its parameters on the (JavaScript)
    stack, which made it impossible to use in TurboFan. Actually
    StringCompareStub was currently completely unused. This changes the
    calling convention to something TurboFan compatible and introduces a
    CallInterfaceDescriptor for StringCompareStub. It also changes
    HStringCompareAndBranch to use the StringCompareStub instead of using
    the full blown CompareICStub for a stupid string comparison.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1358553002

Cr-Commit-Position: refs/heads/master@{#30837}

Port 593c655a

Original commit message:
    This removes the weird COMPARE and COMPARE_STRONG JavaScript builtins
    and replaces them with a proper C++ implementation in Object::Compare
    and appropriate wrappers Object::LessThan, Object::GreaterThan, and
    friends that are intended to be used by a true/false returning CompareIC
    in the future, as well as the interpreter.  As a short-term solution we
    provide %Compare and %Compare_Strong entry points for the current
    CompareIC that return the appropriate integer values expected by
    fullcodegen currently.

    Now the Abstract Relational Comparison is also using the correct
    ToPrimitive implementation, which properly supports @@toPrimitive.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1356983002

Cr-Commit-Position: refs/heads/master@{#30836}

It's been enabled since M45, which is now well into its stable period,
with no problems reported.

Review URL: https://codereview.chromium.org/1356793002

Cr-Commit-Position: refs/heads/master@{#30835}

This changes the error message for code like:

  if (false) let x;

from "Block-scoped declarations (let, const, function, class) not yet supported outside strict mode"
to "Unexpected identifier" (pointing at |x|).

Review URL: https://codereview.chromium.org/1356783002

Cr-Commit-Position: refs/heads/master@{#30834}

Akin to linear scan's TryReuseSpillForPhi, we attempt to merge the
spill ranges of grouped live ranges (which are phi inputs and output),
to avoid inefficient slot-to-slot moves.

BUG=

Review URL: https://codereview.chromium.org/1353023003

Cr-Commit-Position: refs/heads/master@{#30833}

This way we can finally remove the ES5 ToPrimitive builtin from
runtime.js, and the Date Constructor now properly supports
@@toPrimitive for the single argument case as well.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=rossberg@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1346893003

Cr-Commit-Position: refs/heads/master@{#30832}

R=jochen@chromium.org
BUG=chromium:533342
LOG=N

Review URL: https://codereview.chromium.org/1349723005

Cr-Commit-Position: refs/heads/master@{#30831}

R=jochen@chromium.org
BUG=chromium:533243
LOG=N

Review URL: https://codereview.chromium.org/1356863002

Cr-Commit-Position: refs/heads/master@{#30830}

port b5588f48 (r30767).

original commit message:

    There isn't a plan to turn it on soon, so we'll take it out in favor of cleaner code.

BUG=

Review URL: https://codereview.chromium.org/1346043005

Cr-Commit-Position: refs/heads/master@{#30829}

port d5bbd45f (r30808).

oringial commit message:

    Currently Execution::Call (and friends) still duplicate a lot of the
    Call sequence logic that should be encapsulated in the Call and
    CallFunction builtins. So the plan now is to switch Execution::Call
    to accept any Callable and just pass that through to the Call builtin.

BUG=

Review URL: https://codereview.chromium.org/1350183005

Cr-Commit-Position: refs/heads/master@{#30828}

port 905e008c (r30758)

BUG=

Review URL: https://codereview.chromium.org/1352173002

Cr-Commit-Position: refs/heads/master@{#30827}

port a3d6f6cc (r30759).

original commit message:

    Implement the String constructor completely as native builtin,
    avoiding the need to do gymnastics in JavaScript builtin to
    properly detect the no argument case (which is different from
    the undefined argument case) and also allowing to just
    tailcall through to ToString or SymbolDescriptiveString for
    the common case. Also the JavaScript builtin was misleading
    since the case for construct call was unused, but could be
    triggered in a wrong way once we support tail calls from
    constructor functions.

    This refactoring allows us to properly implement subclassing
    for String builtins, once we have the correct initial_map on
    derived classes (it's merely a matter of using NewTarget
    instead of the target register now).

    This introduces a new %SymbolDescriptiveString runtime
    entry, which is also used by Symbol.toString() now.

BUG=

Review URL: https://codereview.chromium.org/1349403002

Cr-Commit-Position: refs/heads/master@{#30826}

Reuse code for copying arguments and pushing/shifting elements.

BUG=

Review URL: https://codereview.chromium.org/1346013005

Cr-Commit-Position: refs/heads/master@{#30825}

Port 09f41681

Original commit message:
The patch decreases the calls of huge switch instructions making the
DecodeType*() functions to work in one phase and optimizing
Instruction::InstructionType(). Speed gain in release full check is
about 33% (6:13 s -> 4:09 s) and in optdebug full test is about 50%
(12:29 -> 6:17)

BUG=

Review URL: https://codereview.chromium.org/1356693002

Cr-Commit-Position: refs/heads/master@{#30824}

BUG=

Review URL: https://codereview.chromium.org/1350293002

Cr-Commit-Position: refs/heads/master@{#30823}

Pure refactoring.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1354613002

Cr-Commit-Position: refs/heads/master@{#30822}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1353103002

Cr-Commit-Position: refs/heads/master@{#30821}

The previous code took advantage of the fact that a group's deps are implicitly public, but I'm trying to fix that. This also cleans up some duplicated code between component and non-component builds.

Review URL: https://codereview.chromium.org/1356723002

Cr-Commit-Position: refs/heads/master@{#30820}

This extends instrumentation added in r30683 and r30768 to cover
the possibility that the root cause we're after is in optimized code.

This CL is intended to be reverted in a couple of days, but should
cause no harm while it's in the tree (we would crash anyway).

BUG=chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1348823003

Cr-Commit-Position: refs/heads/master@{#30819}

The StringCompareStub used to take its parameters on the (JavaScript)
stack, which made it impossible to use in TurboFan. Actually
StringCompareStub was currently completely unused. This changes the
calling convention to something TurboFan compatible and introduces a
CallInterfaceDescriptor for StringCompareStub. It also changes
HStringCompareAndBranch to use the StringCompareStub instead of using
the full blown CompareICStub for a stupid string comparison.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1347913003

Cr-Commit-Position: refs/heads/master@{#30818}

NOTRY=true

Review URL: https://codereview.chromium.org/1342263003

Cr-Commit-Position: refs/heads/master@{#30817}

This removes the weird COMPARE and COMPARE_STRONG JavaScript builtins
and replaces them with a proper C++ implementation in Object::Compare
and appropriate wrappers Object::LessThan, Object::GreaterThan, and
friends that are intended to be used by a true/false returning CompareIC
in the future, as well as the interpreter.  As a short-term solution we
provide %Compare and %Compare_Strong entry points for the current
CompareIC that return the appropriate integer values expected by
fullcodegen currently.

Now the Abstract Relational Comparison is also using the correct
ToPrimitive implementation, which properly supports @@toPrimitive.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1350113002

Cr-Commit-Position: refs/heads/master@{#30816}

Rolling v8/tools/clang to 0e7dbd100f91096de47919f394ac0b32dd7c21a2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1355633003

Cr-Commit-Position: refs/heads/master@{#30815}