This increases the size of addressable constant pool entries for jumps
to match other bytecodes using operands indexing the constant pool.

This change also introduces reservations for constant pool entries.
Reservations are used for forward jumps to ensure a constant pool entry
will be available when the jump target (label) is bound and the jump is
patched up in the bytecode array.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1546683002

Cr-Commit-Position: refs/heads/master@{#33125}

BUG=v8:811
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1558053002

Cr-Commit-Position: refs/heads/master@{#33124}

Deferring enabling of tests to separate per platform CLs.

R=machenbach@chromium.org,titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1553083003

Cr-Commit-Position: refs/heads/master@{#33123}

Review URL: https://codereview.chromium.org/1542143003

Cr-Commit-Position: refs/heads/master@{#33122}

NOTRY=true
TBR=rmcilroy@chromium.org, mythria@chromium.org
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1562463002

Cr-Commit-Position: refs/heads/master@{#33121}

Throws an error if rest parameters are used. This feature is not
yet supported in interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1561603002

Cr-Commit-Position: refs/heads/master@{#33120}

For a prototype chain foo -> global_proxy -> global_object, we used to
register a dependency from foo -> global_object. This is incorrect when
the global_proxy/global_object pairing is modified, e.g. when navigating
in iframes. With this patch, we properly register foo -> global_proxy and
global_proxy -> global_object dependencies.
Additionally, when a prototype's prototype changes from null to something
else, this new usage relation must be registered if there are other users
further down on the prototype chain that might expect a complete chain of
registrations to exist (which was the case before, and must be preserved).

BUG=chromium:571517
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1559323002

Cr-Commit-Position: refs/heads/master@{#33119}

Port a94d6d6e

Original commit message:
    The mode requires an extra register, and since we aren't supporting
    it now, we can dispense with it.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1559013005

Cr-Commit-Position: refs/heads/master@{#33118}

After this change, https://codereview.chromium.org/1475383002 we should
not pass Smi 0 for a closure and expect runtime to look it up. We should
pass the correct argument always.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1558153002

Cr-Commit-Position: refs/heads/master@{#33117}

Fixes StateValuesRequireUpdate function to return false if deoptimization is not enabled.
When deoptimization is not enabled there is no need to create nodes for state values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1551363002

Cr-Commit-Position: refs/heads/master@{#33116}

Deopt support is added on two levels. On the IR level,
a new ObjectState node is added, which represenents an
object to be materialized. ObjectState nodes appear as
inputs of FrameState and StateValues nodes. On the
instruction select/code-generation level, the
FrameStateDescriptor class handles the nesting
introduced by ObjectState, and ensures that deopt code
with CAPTURED_OBJECT/DUPLICATED_OBJECT entries are
generated similarly to what crankshaft's escape
analysis does.

Two unittests test correctness of the IR level implementation.

Correctness for instruction selection / code generation
is tested by mjsunit tests.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1485183002

Cr-Commit-Position: refs/heads/master@{#33115}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1559013004

Cr-Commit-Position: refs/heads/master@{#33114}

BUG=chromium:574349
LOG=NO

Review URL: https://codereview.chromium.org/1553233003

Cr-Commit-Position: refs/heads/master@{#33113}

This changes representation inference to be bidirectional:
1. truncations are propagated from uses to definitions.
2. output types are propagated from definitions to uses.
(and nodes are revisited until fixpoint.)

At the moment, (2) is used only superficially; the idea here is to
use the output type propagation to propagate types from type feedback.

For the output types to be usable, we need to keep track of the type
of the JavaScript value rather than the truncated value. Otherwise,
representation inference could not rely on the ranges indicated
by the values.

For example, for "var b = (a|0) + (a|0); return (b/16) >>> 0",
the type of b cannot be int32; otherwise the division "b/16"
would believe that it is fine to do an integer division on
the truncated value, which would give a wrong result for
2^31 <= a < 2^32.

The change makes representation inference a bit more expensive
(the phase is about 20% slower), but since this is only small part
of the overall compiler time, the overall effect is negligible.
If the running time becomes a problem, we could optimize this by
remembering when the nodes are stable (ie., no further changes to
type/truncations) and/or explicit subscriptions for changes.

BUG=v8:4583
R=bmeurer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1490763003

Cr-Commit-Position: refs/heads/master@{#33112}

Adds implementation and tests for wide variant of load/store lookup slots.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1555063002

Cr-Commit-Position: refs/heads/master@{#33111}

  The FP parameters for X87 should be put in stack and the FP return value
  should be put in stX_0 register.

  So this CL defines the FP_RETURN_REGISTERS as stX_0 only.

BUG=

Review URL: https://codereview.chromium.org/1545203002

Cr-Commit-Position: refs/heads/master@{#33110}

Almost all of the Date builtins always call into C++ at least once
anyway, so parsing, compiling and executing the JavaScript wrappers
is just a waste of time.  The most important part here is the Date
constructor itself, which is one of the blockers for new.target in
TurboFan, because compiling the Date constructor takes too much time
with TurboFan (for no reason since we end up in C++ anway).

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1556333002

Cr-Commit-Position: refs/heads/master@{#33109}

The mode requires an extra register, and since we aren't supporting
it now, we can dispense with it.

BUG=

Review URL: https://codereview.chromium.org/1559903003

Cr-Commit-Position: refs/heads/master@{#33108}

R=bmeurer@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1559003002

Cr-Commit-Position: refs/heads/master@{#33107}

This also fixes a related bug in phi handling.

R=bmeurer@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1554073003

Cr-Commit-Position: refs/heads/master@{#33106}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1557883002

Cr-Commit-Position: refs/heads/master@{#33105}

BUG=v8:4280
LOG=N
TBR=rmcilroy@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1555003004

Cr-Commit-Position: refs/heads/master@{#33104}

  port 02072112(r33088)

  original commit message:
  Fix stack push issues on non-x64 platforms for
  InterpreterNotifyDeoptimized builtins.

BUG=

Review URL: https://codereview.chromium.org/1553083005

Cr-Commit-Position: refs/heads/master@{#33103}

  port 82ca2a41(r33084)

  original commit message:
  This is preferable because in TurboFan we need to call it, and can't pass
  untagged external pointers on the stack.

BUG=

Review URL: https://codereview.chromium.org/1557283002

Cr-Commit-Position: refs/heads/master@{#33102}

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@chromium.org
BUG=

Add for loop to asm-to-wasm

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com

Review URL: https://codereview.chromium.org/1530093002

Cr-Commit-Position: refs/heads/master@{#33101}

In the Date constructor or Date.parse, other browsers will accept time
zones like GMT-8, but before this patch, Chrome would interpret 8 as
8 minutes. This patch interprets GMT-+ a one or two digit number as hours,
not minutes.

R=adamk,jshin@chromium.org
LOG=Y
BUG=chromium:422858

Review URL: https://codereview.chromium.org/1557053002

Cr-Commit-Position: refs/heads/master@{#33100}

Fix build break.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1556063004

Cr-Commit-Position: refs/heads/master@{#33099}

Port 02072112

Original commit message:
    Fix stack push issues on non-x64 platforms for
    InterpreterNotifyDeoptimized builtins.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1554273002

Cr-Commit-Position: refs/heads/master@{#33098}

1. Location names with more than one underscores (e.g. Ho_Chi_Minh)
   didn't work because of the way capturing works with repeated patterns
   in RE. It's now supported by changing the RE to capture the whole string
   and splitting on '_' in the next step.

2. Adds support for location names with a hyphen

3. Adds support for timezone ids with three parts (e.g.
   American/Argentina/Buenos_Aires)

4. Adds special handling of 'au', 'es' and 'of' in zone ids. They need to be kept in lowercase. (see the full list at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones )

5. Adds regression tests for all the above and make the existing tests
   more robust against future ICU changes. ICU canonicalizes zone names to
   deprecated names, but it may change. (
   http://bugs.icu-project.org/trac/ticket/12044 )

BUG=364374
LOG=Y

Review URL: https://codereview.chromium.org/1529363005

Cr-Commit-Position: refs/heads/master@{#33097}

Adds an ignition whitelist for cctests.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1557893002

Cr-Commit-Position: refs/heads/master@{#33096}

This patch adds the basis for subclassing TypedArrays, Arrays and
ArrayBuffers through the @@species hook, added in ES2015. This is
the first patch in a series. This patch simply defines the
@@species Symbol and installs it on the appropriate constructors.
The behavior is guarded behind the --harmony-species flag.

R=cbruni
BUG=v8:4093
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1558543002

Cr-Commit-Position: refs/heads/master@{#33095}

Fixes a number of test262 tests, including

- built-ins/Promise/resolve/resolve-from-promise-capability.js
- built-ins/Promise/resolve/context-non-object-with-promise.js
- built-ins/Promise/executor-function-length.js

BUG=v8:4633
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1536013002

Cr-Commit-Position: refs/heads/master@{#33094}

There were some functions that were used when atomic floats were supported, but
can now be removed.

BUG=

Review URL: https://codereview.chromium.org/1552683003

Cr-Commit-Position: refs/heads/master@{#33093}

Port 82ca2a41

Original commit message:
    This is preferable because in TurboFan we need to call it, and can't pass
    untagged external pointers on the stack.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1553143002

Cr-Commit-Position: refs/heads/master@{#33092}

New bytecodes for making registers with indicies wider than 1-byte
accessible.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1555713002

Cr-Commit-Position: refs/heads/master@{#33091}

Adds --turbo to the set of flags run with ignition (making the
configuration pure Ignition+TurboFan except for fallbacks to
full-codegen for catch / eval). Also changes the default
--ignition-filter to allow everything, rather than omit everything.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1537433003

Cr-Commit-Position: refs/heads/master@{#33090}

Add control for the ignition test suites. This will be
followed by a change on the infra side that targets the
ignition set instead of the hardcoded mjsunit.

After that, cctest can be enabled in a separate CL. This CL
already includes the logic for running cctest for ignition
on swarming.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1559943002

Cr-Commit-Position: refs/heads/master@{#33089}

Fix stack push issues on non-x64 platforms for
InterpreterNotifyDeoptimized builtins.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1553123002

Cr-Commit-Position: refs/heads/master@{#33088}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1559923002

Cr-Commit-Position: refs/heads/master@{#33087}

VisitNewLocalBlockContext funciton was allocating two registers and checking
if they are consecutive. This cl changes it to reserve consecutive registers.
The earlier code breaks this test mjsunit/regress/regress-542099.js.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1545003003

Cr-Commit-Position: refs/heads/master@{#33086}