It should be possible to cast a Value to Int32 without throwing an exception
when IsInt32() is true. Same for Uint32.

BUG=chromium:462402
LOG=Y

Review URL: https://codereview.chromium.org/1003663002

Cr-Commit-Position: refs/heads/master@{#27156}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1002673002

Cr-Commit-Position: refs/heads/master@{#27155}

BUG=chromium:460917
LOG=Y

Review URL: https://codereview.chromium.org/1000893003

Cr-Commit-Position: refs/heads/master@{#27154}

Cleanup: Better helpers, unified line splitting. Also asserting that without
strong mode, the snippets don't produce errors.

Fix: The eval related tests were wrong (we didn't make sure that the error
thrown comes from strong scoping and is not a normal runtime error).

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/993393002

Cr-Commit-Position: refs/heads/master@{#27153}

Port 84e90b2d

Original commit message:
Four tests are failing due to a problem with no frame ranges.

TEST=cctest/test-cpu-profiler/CollectDeoptEvents
BUG=

Review URL: https://codereview.chromium.org/1000723002

Cr-Commit-Position: refs/heads/master@{#27152}

TBR=verwaest@chromium.org

BUG=466086
LOG=N

Review URL: https://codereview.chromium.org/998213002

Cr-Commit-Position: refs/heads/master@{#27151}

This moves the decision whether to report a message or not to when
the pending exception is propagated instead of trying to preserve the
decision in a ThreadLocalTop field.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/998943003

Cr-Commit-Position: refs/heads/master@{#27150}

We can reduce the number of type feedback vector slots required, and
also reduce IC misses.

Review URL: https://codereview.chromium.org/1001533002

Cr-Commit-Position: refs/heads/master@{#27149}

A diamond is unused if the Merge node has no Phi/EffectPhi uses, exactly
two inputs, one IfTrue and one IfFalse, which have the same Branch
control input and no other uses except for the Merge. In this case the
diamond can safely be removed.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1000883003

Cr-Commit-Position: refs/heads/master@{#27148}

TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1004583002

Cr-Commit-Position: refs/heads/master@{#27147}

... and improve protection against trampoline table generation in this
sequence.

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/985933003

Cr-Commit-Position: refs/heads/master@{#27146}

The test/cctest/cctest.status and test/mjsunit/mjsunit.status
tests now pass under the simulator so removing these
excludes

	modified:   test/cctest/cctest.status
	modified:   test/mjsunit/mjsunit.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/995393003

Cr-Commit-Position: refs/heads/master@{#27145}

Port f71e2626

Original commit message:
This removes the separate tracking of the pending message script,
because that script is already stored in the message object and
duplicating it in the ThreadLocalTop makes it more brittle.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/995013005

Cr-Commit-Position: refs/heads/master@{#27127}

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/999093002

Cr-Commit-Position: refs/heads/master@{#27144}

Since recursive modules are gone, only the top-level scope can have
module inner scopes. Rename Scope::AllocateModulesRecursively to
Scope::AllocateModules, and add test showing the module Variables
are still allocated appropriately in the top level scope.

BUG=v8:1569,v8:3940
LOG=n

Review URL: https://codereview.chromium.org/999893003

Cr-Commit-Position: refs/heads/master@{#27143}

We need the v8 snapshot to be compiled on the host cpu (the
machine doing the build), but using generated code that has the
same pointer size as the target_arch; i.e., for 32-bit arm builds,
we need to use a 32-bit x86 host binary, not a 64-bit host binary.

The easiest way to ensure that this happens is to just specify
a custom toolchain in GN to use to build the snapshot.

R=jochen@chromium.org, cjhopman@chromium.org
BUG=465456, 395249
LOG=Y

Review URL: https://codereview.chromium.org/993173003

Cr-Commit-Position: refs/heads/master@{#27142}

The problem is that tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
This CL also adds useful machinery that helps triggering incremental write barriers.

BUG=chromium:454297, chromium:465273
LOG=Y

Review URL: https://codereview.chromium.org/988363002

Cr-Commit-Position: refs/heads/master@{#27141}

Port f71e2626

Original commit message:
This removes the separate tracking of the pending message script,
because that script is already stored in the message object and
duplicating it in the ThreadLocalTop makes it more brittle.

BUG=

Review URL: https://codereview.chromium.org/999763003

Cr-Commit-Position: refs/heads/master@{#27140}

Port a925f3f4

Original commit message:
The same idea as in https://codereview.chromium.org/984893003/

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/993233003

Cr-Commit-Position: refs/heads/master@{#27139}

This further reduces the context size.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/996213003

Cr-Commit-Position: refs/heads/master@{#27138}

Outside of runtime.h, only the distinction between intrinsics
returning pairs and those returning pairs is really meaningful, not
the internal traditional partitioning of them.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/997933003

Cr-Commit-Position: refs/heads/master@{#27137}

cctest/test-deoptimization/DeoptimizeCompare was failing on PPC because the path that is optimized for isel incorrectly used integer values instead of Smi's

BUG=

Review URL: https://codereview.chromium.org/996223002

Cr-Commit-Position: refs/heads/master@{#27136}

Combined the various lists, the only slightly ugly thing is now the
distinction between intrinsics returning pairs and the rest, but
that's no big deal.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/989273003

Cr-Commit-Position: refs/heads/master@{#27135}

I did some investigation and found that in the most cases
the old schema with the separate List for functions and inlines
gives us no memory benefits because more frequently we inlines
different functions into parent function. So the plain schema
wins a tens or even hundreds bytes a few thousand times.

The only drawback is that we will print the inlined body
the each time when we inline it. But is not a problem
because it happens only under FLAG_hydrogen_track_positions.

Also I added script_id to the structure, so it could be used later
by cpu-profiler.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/996153003

Cr-Commit-Position: refs/heads/master@{#27134}

Port a925f3f4

Original commit message:
The same idea as in https://codereview.chromium.org/984893003/

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/996883002

Cr-Commit-Position: refs/heads/master@{#27133}

The external v8::TryCatch handler was computed eagerly and kept in
intact. This changes it to be computed lazily for simplicity and
readability of the code.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/997863003

Cr-Commit-Position: refs/heads/master@{#27132}

This recovers the performance loss for some ancient benchmarks.
Added some comments/UNIMPLEMENTED on the way.

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/996153002

Cr-Commit-Position: refs/heads/master@{#27131}

BUG=v8:3929
LOG=n

Review URL: https://codereview.chromium.org/998943002

Cr-Commit-Position: refs/heads/master@{#27130}

BUG=

Review URL: https://codereview.chromium.org/998893002

Cr-Commit-Position: refs/heads/master@{#27129}

Just visit young array buffers during scavenge. Additionally keep the views in new space in a separate global list and move them to the corresponding array buffers when they get promoted.

BUG=

Review URL: https://codereview.chromium.org/990423004

Cr-Commit-Position: refs/heads/master@{#27128}

This removes the separate tracking of the pending message script,
because that script is already stored in the message object and
duplicating it in the ThreadLocalTop makes it more brittle.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/995013005

Cr-Commit-Position: refs/heads/master@{#27127}

BUG=

Review URL: https://codereview.chromium.org/993223003

Cr-Commit-Position: refs/heads/master@{#27126}

Contribution of PowerPC port (continuation of 422063005,
817143002,866843003, and 901083004). This patch updates
the ppc directories to make them current with changes in
common code as of today.

We had to exclude the test test-serialize/SerializeInternalReference
until we agree on the right way to add those changes for PPC as
outlined in the description in the google doc provided earlier.

We also had to exclude a couple of other tests due to new
failures seen since the last uplevel.  We excluded as opposed
to waiting until we could investigate to maximize the chance
of getting PPC compiling in the google repos before new
breaking changes are made.

I'll note that before applying any of our changes the
mozilla part of quickcheck was already broken when using
the lastest repo content so I had to run without that

	modified:   src/compiler/ppc/code-generator-ppc.cc
	modified:   src/compiler/ppc/instruction-codes-ppc.h
	modified:   src/compiler/ppc/instruction-selector-ppc.cc
	modified:   src/ic/ppc/handler-compiler-ppc.cc
	modified:   src/ic/ppc/ic-compiler-ppc.cc
	modified:   src/ppc/assembler-ppc-inl.h
	modified:   src/ppc/assembler-ppc.cc
	modified:   src/ppc/assembler-ppc.h
	modified:   src/ppc/builtins-ppc.cc
	modified:   src/ppc/code-stubs-ppc.cc
	modified:   src/ppc/codegen-ppc.cc
	modified:   src/ppc/full-codegen-ppc.cc
	modified:   src/ppc/lithium-codegen-ppc.cc
	modified:   src/ppc/macro-assembler-ppc.cc
	modified:   src/ppc/macro-assembler-ppc.h
	modified:   test/cctest/cctest.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/994533004

Cr-Commit-Position: refs/heads/master@{#27125}

We should be able to cast a Value to Boolean when IsBoolean() is true.

Review URL: https://codereview.chromium.org/990943003

Cr-Commit-Position: refs/heads/master@{#27124}

Port 36e69a91

Original commit message:
This reduces the size of the StackHandler by yet another word. We no
longer need to keep track of the frame pointer, as the stack walk will
be able to recalculate it.

BUG=

Review URL: https://codereview.chromium.org/997663002

Cr-Commit-Position: refs/heads/master@{#27123}

BUG=v8:3954
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/987203003

Cr-Commit-Position: refs/heads/master@{#27122}

the implementation doesn't yet throw on strict mode assignment

BUG=

Review URL: https://codereview.chromium.org/992913002

Cr-Commit-Position: refs/heads/master@{#27121}

Port e0aa8ebf

Original commit message:
This reduces the size of the StackHandler by one word. We no longer
need to keep track of the code object, as the stack walk finds it.

BUG=

Review URL: https://codereview.chromium.org/990903008

Cr-Commit-Position: refs/heads/master@{#27120}

Port 8d946b9c

Original commit message:
The prototype of a class constructor function is read only. When we set
computed property names we were ignoring this and we were overriding the
property.

Since the prototype is the only possible own read only property on the
constructor function object we special case this so we do not have to
check this for every property in the class literal.

BUG=v8:3945
LOG=N

Review URL: https://codereview.chromium.org/993963003

Cr-Commit-Position: refs/heads/master@{#27119}

This CL adds errors for illegal references which occur inside object literal
methods inside computed properrty names.

BUG=v8:3948,v8:3956
LOG=N

Review URL: https://codereview.chromium.org/994043003

Cr-Commit-Position: refs/heads/master@{#27118}

Port 022ea7e0

Original commit message:
Provide an intrinsic %MathFloor / %_MathFloor that is used to optimize
both Math.ceil and Math.floor, and use the JS inlining mechanism to
inline Math.ceil into TurboFan code. Although we need to touch code
outside of TurboFan to make this work, this does not affect the way we
handle Math.ceil and/or Math.floor in CrankShaft, because for CrankShaft
the old-style builtin function id based inlining still kicks in first.

Once this solution is stabilized, we can use it for Math.floor as well.
And once that is settled, we can establish it as the unified way to
inline builtins, and get rid of the specialized builtin function id
based inlining at some point.

Note that "builtin" applies to basically every piece of internal
JavaScript/intrinsics based code, so this also applies to the yet to be
defined JavaScript based code stubs and handlers.

BUG=v8:3953
LOG=n

Review URL: https://codereview.chromium.org/998503002

Cr-Commit-Position: refs/heads/master@{#27117}