BUG=497295
LOG=n

Review URL: https://codereview.chromium.org/1422533009

Cr-Commit-Position: refs/heads/master@{#32064}

R=cbruni, rossberg
BUG=

Review URL: https://codereview.chromium.org/1453583002

Cr-Commit-Position: refs/heads/master@{#32063}

TEST=unittests/InstructionSelectorTest/Word32ShrWithWord32AndWithImmediate,
     Word32AndWithImmediateWithWord32Shr, Word64AndWithImmediateWithWord64Shr,
     Word64AndWithImmediateWithWord64Shr
BUG=

Review URL: https://codereview.chromium.org/1457523002

Cr-Commit-Position: refs/heads/master@{#32062}

TEST=unittests/InstructionSelectorTest.CombineShiftsWithMul,
     InstructionSelectorTest.CombineShiftsWithDivMod
BUG=

Review URL: https://codereview.chromium.org/1444423002

Cr-Commit-Position: refs/heads/master@{#32061}

Port 14ec485c

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1455563005

Cr-Commit-Position: refs/heads/master@{#32060}

Port e5edd66d

Original commit message:
    This is the first part to refactoring the JSNativeContextSpecialization
    class, which has grown way too big recently.

    Also don't collect cross context feedback for the CallIC in general.
    Neither TurboFan nor Crankshaft can make any use of cross context
    JSFunction feedback that is collected by the CallIC, so there's no
    point in gathering that feedback at all (it just complicates the
    checking that is necessary in the compilers). What we should do
    instead at some point (when Crankshaft becomes less important) is
    to collect the SharedFunctionInfo as feedback for those cases.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1455663002

Cr-Commit-Position: refs/heads/master@{#32059}

Port e75e6254

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1448403002

Cr-Commit-Position: refs/heads/master@{#32058}

The current typing-asm mishandles the relationship between
unsigned numbers and int. Restructuring and using type shortcuts
that approximate asm types.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1447133002

Cr-Commit-Position: refs/heads/master@{#32057}

Port 906903ac

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1454783002

Cr-Commit-Position: refs/heads/master@{#32056}

Port 07c1d181

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1452213003

Cr-Commit-Position: refs/heads/master@{#32055}

Review URL: https://codereview.chromium.org/1448843002

Cr-Commit-Position: refs/heads/master@{#32054}

BUG=

Review URL: https://codereview.chromium.org/1456543003

Cr-Commit-Position: refs/heads/master@{#32053}

Per http://tc39.github.io/ecma262/#sec-identifiers-static-semantics-early-errors (13.2.2),
make it a SyntaxError if an Identifier has the same StringValue as a ReservedWord.

BUG=v8:2222, v8:1972
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, wingo@chromium.org

Review URL: https://codereview.chromium.org/1429983002

Cr-Commit-Position: refs/heads/master@{#32052}

BUG=

Review URL: https://codereview.chromium.org/1455593002

Cr-Commit-Position: refs/heads/master@{#32051}

With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1453733002

Cr-Commit-Position: refs/heads/master@{#32050}

Adds support for the LdaGlobal and StaGlobal bytecodes to the
BytecodeGraphBuilder. Also fixes a bug in the context node's parameter
index and start node inputs.

Landed on behalf of rmcilroy.

TBR=bmeuer@chromium.org,mythria@chromium.org
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1449373002

Cr-Commit-Position: refs/heads/master@{#32049}

With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1452193003

Cr-Commit-Position: refs/heads/master@{#32048}

With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1451423002

Cr-Commit-Position: refs/heads/master@{#32047}

Several changes are included here:

1. Each resolution callback references shared data indicating whether
it has already been resolved or not, as described in 25.4.1.3
http://tc39.github.io/ecma262/#sec-createresolvingfunctions.
Previously this was handled exclusively by the Promise's status,
which does not work correctly with the current chaining behaviour.

2. During fulfillment, When a Promise is resolved with a thenable, the
spec chains the promises together by invoking the thenable's `then`
function with the original Promise's resolve and reject methods (per
section 25.4.2.2, or
http://tc39.github.io/ecma262/#sec-promiseresolvethenablejob, on the
next tick, regardless of whether or not there are pending tasks.

3. Adds a spec compliance fix to ensure that the Promise constructor
is only loaded once when `then()` is called, solving v8:4539 as well.
This involves refactoring PromiseChain to accept a constructor
argument. PromiseChain/PromiseDeferred will hopefully be removed soon,
simplifying the process.

BUG=v8:4162, v8:4539, v8:3237
LOG=N
R=rossberg@chromium.org, littledan@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1394463003

Cr-Commit-Position: refs/heads/master@{#32046}

This disables the eager flushing of optimized code maps during full GCs
and instead treats entries in those tables weakly by default. Note that
for now entries are removed when one of its components dies.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1430293002

Cr-Commit-Position: refs/heads/master@{#32045}

BUG=

Review URL: https://codereview.chromium.org/1453113002

Cr-Commit-Position: refs/heads/master@{#32044}

R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
Cr-Commit-Position: refs/heads/master@{#32029}

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32043}

This splits the work to be done for dead and life maps
and avoids unnecessary operations in the hot loop.

Results for v8.infinite_scroll:

Before:
nonlive_refs
  len: 93
  min: 0.0
  max: 6.3
  avg: 1.35268817204
  [0,5[: 91
  [5,10[: 2

After:
nonlive_refs
  len: 91
  min: 0.0
  max: 4.2
  avg: 0.968131868132
  [0,5[: 91

BUG=chromium:554488
LOG=no

Review URL: https://codereview.chromium.org/1441633002

Cr-Commit-Position: refs/heads/master@{#32042}

Revert of Prepare to enable in-object properties in subclasses on a case by case basis. (patchset #3 id:100001 of https://codereview.chromium.org/1448313002/ )

Reason for revert:
Breaks GC stress: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/3174/steps/Mjsunit/logs/classes-subclass-buil..

Original issue's description:
> Prepare to enable in-object properties in subclasses on a case by case basis.
>
> Minor cleanup in VisitorId selection.
>
> Committed: https://crrev.com/7c449a62edfc03aed84d94da323dcfe2b51a3600
> Cr-Commit-Position: refs/heads/master@{#32030}

TBR=verwaest@chromium.org,mstarzinger@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1449423002

Cr-Commit-Position: refs/heads/master@{#32041}

BUG=

Review URL: https://codereview.chromium.org/1424153003

Cr-Commit-Position: refs/heads/master@{#32040}

Also properly support loading from holey double element backing stores
in JSNativeContextSpecialization. This adds a new simplified operator
NumberIsHoleNaN, which checks whether a certain value is the special NaN
that we use to encode "the hole" in holey double element backing stores.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1448343002

Cr-Commit-Position: refs/heads/master@{#32039}

Revert of Remove redundant activation threshold for incremental marking. (patchset #1 id:1 of https://codereview.chromium.org/1418293006/ )

Reason for revert:
Regression in thread_times.key_idle_power_cases (crbug.com/555153)

Original issue's description:
> Remove redundant activation threshold for incremental marking.
>
> The minimum allocation limit already enforces this constraint for normal GCs.
>
> GCs triggered by the memory reducer and external limit should work for all heap sizes.
>
> BUG=chromium:552305
> LOG=NO
>
> Committed: https://crrev.com/e28e4d5f52852e2f14facc37a02069b6bfc82c4e
> Cr-Commit-Position: refs/heads/master@{#31921}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:552305

Review URL: https://codereview.chromium.org/1456523002

Cr-Commit-Position: refs/heads/master@{#32038}

using the new JSReceiver::GetOwnPropertyDescriptor implementation.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1451703003

Cr-Commit-Position: refs/heads/master@{#32037}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1450353002

Cr-Commit-Position: refs/heads/master@{#32036}

BUG=4134
R=epertoso@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1449393002

Cr-Commit-Position: refs/heads/master@{#32035}

Review URL: https://codereview.chromium.org/1453103002

Cr-Commit-Position: refs/heads/master@{#32034}

Adds support for visiting the Call bytecode to the bytecode graph builder.
This change also adds the call type feedback slot to the Call bytecode.
This is not currently used by the interpreter, but is used by the
graph builder.

Also adds a CallWide varient of the Call bytecode, and adds the kCount16
operand type.

Landed on behalf of rmcilroy.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1456453002

Cr-Commit-Position: refs/heads/master@{#32033}

Revert of Experimental support for RegExp lookbehind. (patchset #18 id:340001 of https://codereview.chromium.org/1418963009/ )

Reason for revert:
gc stress breaks due to string_start_minus_one not being set correctly.

Original issue's description:
> Experimental support for RegExp lookbehind.
>
> R=erikcorry@chromium.org, littledan@chromium.org
> BUG=v8:4545
> LOG=N
>
> Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
> Cr-Commit-Position: refs/heads/master@{#32029}

TBR=littledan@chromium.org,erikcorry@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4545

Review URL: https://codereview.chromium.org/1451373003

Cr-Commit-Position: refs/heads/master@{#32032}

and ppc64.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1438013003

Cr-Commit-Position: refs/heads/master@{#32031}

Minor cleanup in VisitorId selection.

Review URL: https://codereview.chromium.org/1448313002

Cr-Commit-Position: refs/heads/master@{#32030}

R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32029}

Review URL: https://codereview.chromium.org/1452113002

Cr-Commit-Position: refs/heads/master@{#32028}

Review URL: https://codereview.chromium.org/1453043003

Cr-Commit-Position: refs/heads/master@{#32027}

Adds implementation and tests for following operators in bytecode graph builder:
-VisitLoadICSloppy
-VisitLoadICStrict
-VisitLoadICSloppyWide
-VisitLoadICStrictWide

The current implementation introduces empty frame states for frame state inputs expected by these operations.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1419373007

Cr-Commit-Position: refs/heads/master@{#32026}

BUG=chromium:556543
LOG=n

Review URL: https://codereview.chromium.org/1450883003

Cr-Commit-Position: refs/heads/master@{#32025}