All the builtin iterators as well as the generator objects have an
object called %IteratorPrototype% in the spec between them and
%ObjectPrototype%.

BUG=v8:3568
LOG=N

Review URL: https://codereview.chromium.org/1128233008

Cr-Commit-Position: refs/heads/master@{#28426}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1127333004

Cr-Commit-Position: refs/heads/master@{#28425}

R=hablich@chromium.org
BUG=chromium:487289
LOG=N

Review URL: https://codereview.chromium.org/1137293002

Cr-Commit-Position: refs/heads/master@{#28424}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1140053002

Cr-Commit-Position: refs/heads/master@{#28423}

Now that vector ics are established for load, keyed load and call ics, let's remove dead code behind the flag.

BUG=

Review URL: https://codereview.chromium.org/1129853002

Cr-Commit-Position: refs/heads/master@{#28422}

Unnecessary, and unhandled as well.

BUG=488398
R=jarin@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1141163004

Cr-Commit-Position: refs/heads/master@{#28421}

This slightly reduces the initial context size.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1146523002

Cr-Commit-Position: refs/heads/master@{#28420}

First step towards support for inlining based on SharedFunctionInfo
instead of JSFunction.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134713004

Cr-Commit-Position: refs/heads/master@{#28419}

Map::ReconfigureProperty() should mark map as unstable when there is an element kind transition somewhere in the middle of the transition tree.

BUG=chromium:485548
LOG=N

Review URL: https://codereview.chromium.org/1128043005

Cr-Commit-Position: refs/heads/master@{#28418}

BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1128043006

Cr-Commit-Position: refs/heads/master@{#28417}

When context disposal rate is high and we cannot perform a full GC, we do nothing until the context disposal rate becomes lower.

BUG=chromium:473351
LOG=n

Review URL: https://codereview.chromium.org/1118303004

Cr-Commit-Position: refs/heads/master@{#28416}

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1124403006

Cr-Commit-Position: refs/heads/master@{#28415}

We want to move to a world where there's no Isolate::Current but we
always knows which isolate we're in. There's no way we can teach this
info to the C++ allocator.

BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1128023005

Cr-Commit-Position: refs/heads/master@{#28414}

This is called from Runtime, and was dropping the requested alignment
for doubles. Needed for upcoming MIPS CL to remove some more
workarounds for load/store doubles.

BUG=

Review URL: https://codereview.chromium.org/1131123003

Cr-Commit-Position: refs/heads/master@{#28413}

Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1131573006

Cr-Commit-Position: refs/heads/master@{#28412}

Rolling v8/tools/clang to 50042056ee1589e57bdb6ecba4609a7da51c7ec4

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1136353003

Cr-Commit-Position: refs/heads/master@{#28411}

BUG=none
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1143583002

Cr-Commit-Position: refs/heads/master@{#28410}

ES6 specifies that methods on TypedArrays reference an internal length
slot, rather than their length property. This patch tests that for the
TypedArray methods that exist currently.

R=arv@chromium.org
BUG=v8:3578
LOG=Y

Review URL: https://codereview.chromium.org/1130413010

Cr-Commit-Position: refs/heads/master@{#28409}

BUG=none
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1144523004

Cr-Commit-Position: refs/heads/master@{#28408}

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1127963005

Cr-Commit-Position: refs/heads/master@{#28407}

R=vogelheim@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1123203003

Cr-Commit-Position: refs/heads/master@{#28406}

BUG=v8:4105, v8:3018
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1132933003

Cr-Commit-Position: refs/heads/master@{#28405}

Reason for revert:
Simulator test failures in RunChangeFloat64ToInt.., RunChangeTaggedToInt32,
div-mul-minus-one

Original issue's description:

> Implement assembler, disassembler tests for all instructions for mips32
> and mips64. Additionally, add missing single precision float instructions
> for r2 and r6 architecture variants in assembler, simulator and disassembler
> with corresponding tests.

BUG=

Review URL: https://codereview.chromium.org/1143473003

Cr-Commit-Position: refs/heads/master@{#28404}

Revert of Prevent stack overflow in the serializer/deserializer. (patchset #6 id:100001 of https://codereview.chromium.org/1125073004/)

Reason for revert:
[Sheriff] Breaks msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2266

Original issue's description:
> Prevent stack overflow in the serializer/deserializer.
>
> We keep an eye on the recursion depth. Once it exceeds a limit, we serialize
> only the object header and size, but defer serializing the object body for
> after we have unwound the stack.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/36b4a498d6614243454d5a182e4946b0dad24f0a
> Cr-Commit-Position: refs/heads/master@{#28385}

TBR=mvstanton@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1139113002

Cr-Commit-Position: refs/heads/master@{#28403}

Implement assembler, disassembler tests for all instructions for mips32 and mips64. Additionally, add missing single precision float instructions for r2 and r6 architecture variants in assembler, simulator and disassembler with corresponding tests.

Review URL: https://codereview.chromium.org/1119203003

Cr-Commit-Position: refs/heads/master@{#28402}

This reverts commit 6eea2524.

revert reason:
   original patch is reverted.

BUG=

Review URL: https://codereview.chromium.org/1130853007

Cr-Commit-Position: refs/heads/master@{#28401}

Rolling v8/testing/gtest to 23574bf2333f834ff665f894c97bef8a5b33a0a9

Rolling v8/tools/clang to 17e168207560f2dfdf95e50c5eb79e6d3ac1eaf6

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1136913007

Cr-Commit-Position: refs/heads/master@{#28400}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1109763002

Cr-Commit-Position: refs/heads/master@{#28399}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1140943003

Cr-Commit-Position: refs/heads/master@{#28398}

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1123383005

Cr-Commit-Position: refs/heads/master@{#28397}

Only set on strong functions so far to test basic operation.

R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1138243002

Cr-Commit-Position: refs/heads/master@{#28396}

... and the following two
"PPC: Resolve references to "this" the same way as normal variables"
"Remove Scope::scope_uses_this_ flag"

R=hablich@chromium.org
BUG=chromium:487289
LOG=N

Review URL: https://codereview.chromium.org/1134003003

Cr-Commit-Position: refs/heads/master@{#28395}

TBR=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1130073006

Cr-Commit-Position: refs/heads/master@{#28394}

If the typer was able to prove that a NumberAdd/Sub/Mul/Div/Mod always
produces a Signed32/Unsigned32 value, and the inputs are
Signed32/Unsigned32, we can lower the node to the corresponding integer
operation instead, no matter what the uses are.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140933002

Cr-Commit-Position: refs/heads/master@{#28393}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133303006

Cr-Commit-Position: refs/heads/master@{#28392}

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1138153003

Cr-Commit-Position: refs/heads/master@{#28391}

port bd56d279 (R28340).

original commit message:

    Make the parser handle references to "this" as unresolved variables, so the
    same logic as for the rest of function parameters is used for the receiver.
    Minor additions to the code generation handle copying the receiver to the
    context, along with the rest of the function parameters.

    Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=

Review URL: https://codereview.chromium.org/1136953010

Cr-Commit-Position: refs/heads/master@{#28390}

This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}

port 3bce9c3a (r28359).

original commit message:

    HMaybeGrowElements moves the situation where you actually have to grow
    into deferred code. This means crankshaft doesn't have to spill registers
    just to make the bounds comparison to see if it'll need to grow or not.

    It makes the growing case a bit more expensive, but reduces the cost of
    the general case.

BUG=

Review URL: https://codereview.chromium.org/1124093008

Cr-Commit-Position: refs/heads/master@{#28388}

port 3226e980 (28346).

original commit message:

    [strong] Check arity of functions

    In strong mode it is an error to call a function with too few
    arguments.

    This is enforced inside the ArgumentsAdaptorTrampoline.

    This does not yet handle rest parameter

BUG=

Review URL: https://codereview.chromium.org/1139913007

Cr-Commit-Position: refs/heads/master@{#28387}