Implements the strong mode proposal's restrictions on property access.

To be fully explored in a followup: proxies, interceptors, access checks, load from super

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1168093002

Cr-Commit-Position: refs/heads/master@{#29109}

Currently, the desugaring of for loops of the form for
(let/const ...; bla; bla) causes them to always have a
completion value of 1, regardless of whether the loop body
is executed or not. This CL fixes this, realigning
initializer blocks as a more general purpose way to avoid
the completion value rewriter (since that's all they really
do anyway).

BUG=

Review URL: https://codereview.chromium.org/1177053006

Cr-Commit-Position: refs/heads/master@{#29108}

Reland [turbofan] Disable select matching due to bug manifesting on arm. (patchset #2 id:40001 of https://codereview.chromium.org/1176403005/)

Reason for revert:
This causes timeouts in Massive on chromebooks.

Original issue's description:
> Revert of [turbofan] Disable select matching due to bug manifesting on arm. (patchset #1 id:1 of https://codereview.chromium.org/1077613002/)
>
> Reason for revert:
> [Sheriff] Checking if this still fails and if yes persists info about failures.
>
> Original issue's description:
> > [turbofan] Disable select matching due to bug manifesting on arm.
> >
> > R=machenbach@chromium.org
> > BUG=
> >
> > Committed: https://crrev.com/6e5d805718195c4b5ac64cd540379cecf10b8f5c
> > Cr-Commit-Position: refs/heads/master@{#27702}
>
> TBR=bmeurer@chromium.org
>
> Committed: https://crrev.com/7c36a7d91d8706b29df07013085fbe3c8e93b0ed
> Cr-Commit-Position: refs/heads/master@{#29103}

TBR=titzer@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1195563003

Cr-Commit-Position: refs/heads/master@{#29107}

Dampen the old generation allocation limit only after the initial old generation size was configured.

Otherwise, dampening interferes with initial size configuration and causes GC too early.

BUG=501703
LOG=NO

Review URL: https://codereview.chromium.org/1183633005

Cr-Commit-Position: refs/heads/master@{#29106}

This turns the CommonOperatorReducer into an AdvancedReducer and makes
it independent of JSGraph (which was used only because it was convienent),
and let's the CommonOperatorReducer run together with the ControlReducer.

The ControlReducer is still not able to run together with other reducers,
but we're getting closer. The plan is to split the ControlReducer into
two parts: The dead code elimination part and the common operator
reduction part. This separation will help to avoid tricky bugs in the
future and should make testing a *lot* easier.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1192063002

Cr-Commit-Position: refs/heads/master@{#29105}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186033006

Cr-Commit-Position: refs/heads/master@{#29104}

Revert of [turbofan] Disable select matching due to bug manifesting on arm. (patchset #1 id:1 of https://codereview.chromium.org/1077613002/)

Reason for revert:
[Sheriff] Checking if this still fails and if yes persists info about failures.

Original issue's description:
> [turbofan] Disable select matching due to bug manifesting on arm.
>
> R=machenbach@chromium.org
> BUG=
>
> Committed: https://crrev.com/6e5d805718195c4b5ac64cd540379cecf10b8f5c
> Cr-Commit-Position: refs/heads/master@{#27702}

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1176403005

Cr-Commit-Position: refs/heads/master@{#29103}

We never hit the phi case for DecideCondition in practice, since a more
general optimization is already performed by typing and constant
propagation.

R=jarin@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186973005

Cr-Commit-Position: refs/heads/master@{#29102}

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1185623003

Cr-Commit-Position: refs/heads/master@{#29101}

On MIPS32 we can't read a 8 bytes long data from a not 8 bytes aligned memory address.

BUG=
TEST=mjsunit/debug-backtrace

Review URL: https://codereview.chromium.org/1193433002

Cr-Commit-Position: refs/heads/master@{#29100}

Reason for revert:
[Sheriff] gyp still contains an offending patch

Original issue's description:
> Update V8 DEPS.
>
> Rolling v8/build/gyp to fdcd8bc10c935eff13b391644b01460593c46861
>
> Rolling v8/tools/clang to d2b4eddd701ff0265124147bcb0a65f32273f06b
>
> TBR=machenbach@chromium.org
>
> Committed: https://crrev.com/a940eb8a7cba6596ea25819c0112c3ca053074ed
> Cr-Commit-Position: refs/heads/master@{#29097}

TBR=v8-autoroll@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1185453011

Cr-Commit-Position: refs/heads/master@{#29099}

R=bmeurer@chromium.org
TEST=cctest/test-pipeline

Review URL: https://codereview.chromium.org/1193543002

Cr-Commit-Position: refs/heads/master@{#29098}

Rolling v8/build/gyp to fdcd8bc10c935eff13b391644b01460593c46861

Rolling v8/tools/clang to d2b4eddd701ff0265124147bcb0a65f32273f06b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1192033002

Cr-Commit-Position: refs/heads/master@{#29097}

Currently this verifier will post an informative error if the author has not signed CLA, instead of rejecting the CL.

LOG=N

BUG=457428

Review URL: https://codereview.chromium.org/1185193009

Cr-Commit-Position: refs/heads/master@{#29096}

Restores SortNumbers perf degrade

BUG=chromium:495949, v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177043009

Cr-Commit-Position: refs/heads/master@{#29095}

Use it in detection of low young generation allocation rate.

BUG=501314
LOG=NO
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1186903005

Cr-Commit-Position: refs/heads/master@{#29094}

R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1185313002

Cr-Commit-Position: refs/heads/master@{#29093}

R=jochen@chromium.org,jarin@chromium.org
TEST=cctest

Review URL: https://codereview.chromium.org/1176423007

Cr-Commit-Position: refs/heads/master@{#29092}

R=machenbach@chromium.org
NOTRY=y

Review URL: https://codereview.chromium.org/1175123003

Cr-Commit-Position: refs/heads/master@{#29091}

Otherwise we'd have to probe for pending exceptions.

I'll do the same to other interceptors in follow-up CLs

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1190023002

Cr-Commit-Position: refs/heads/master@{#29090}

The condition of a Branch or Select can never be a NumberConstant,
because the resulting graph would be invalid, so we don't need to
optimize this case. It can only ever be a tagged boolean or an untagged
bit.

Drive-by-fix: Test the interesting cases in the unit tests instead.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1195443004

Cr-Commit-Position: refs/heads/master@{#29089}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1187263003

Cr-Commit-Position: refs/heads/master@{#29088}

BUG=
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1188093003

Cr-Commit-Position: refs/heads/master@{#29087}

Currently the Typer is installed on the Graph, no matter if we actually
use the types or not (read: even in the generic pipeline). Also the
Typer tries hard to eagerly type nodes during graph building, which
takes time, just to remove those types later again, and retype
everything from scratch. Plus this is inconsistent, since it only
applies to the outermost graph, not the inlined graphs (which are
eagerly typed once the nodes are copied). So in summary, what's
currently implemented is neither useful nor well defined, so for now we
stick to the full typing approach until a proper design for eager typing
is available that will actually benefit us.

R=rossberg@chromium.org,mstarzinger@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1192553002

Cr-Commit-Position: refs/heads/master@{#29086}

Revert of Added constructor call on object in InstantiateObject method (patchset #5 id:80001 of https://codereview.chromium.org/1137693003/)

Reason for revert:
[Sheriff] This breaks layout test expectations:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/437

See:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/437/layout-test-results/fast/dom/create-element-after-stack-overflow-pretty-diff.html

Please land a needsmanualrebaseline change on the blink-side before relanding this, if the change was intended.

Please include a blink trybot on relanding this.

Original issue's description:
> Added constructor call on object in InstantiateObject method
>
> I found after upgrading from 4.2.2 where apinatives.js still
> existed to 4.4.56 where everything had been converted to C++ in
> api-natives.cc, my constructors for ObjectTemplate instantiated objects
> were no longer being called.  After investigation, I noticed in
> apinatives.js that a new call would handle that, but there was no
> corresponding constructor call in api-natives.cc (or anywhere else
> along the chain of InstantiateObject), so I added a call to
> Execution::Call to actually construct the object.  Forgive me if that
> isn't the right place to add it (InitializeBody in objects-inl.h also
> looked like a good place), or if there's a reason constructors are
> not being called.
>
> I also added myself to the AUTHORS file in this CL.
>
> Committed: https://crrev.com/e61a957b2a9726294cdd2802a6a2b6e3a9ef657d
> Cr-Commit-Position: refs/heads/master@{#29076}

TBR=verwaest@chromium.org,svenpanne@chromium.org,dtalley@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1188233002

Cr-Commit-Position: refs/heads/master@{#29085}

Delayed tasks can be used to perform non-urgent clean up work.

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1179153002

Cr-Commit-Position: refs/heads/master@{#29084}

BUG=

Review URL: https://codereview.chromium.org/1157943003

Cr-Commit-Position: refs/heads/master@{#29083}

- fix truthfulness of comments
- use InitializeFieldsWithFiller more consistently
- use unsigned comparisons for pointers

No change in functionality intended.

Bonus: improve JavaScriptFrame::Print() for an enhanced debugging experience:

- print PC of each frame
- print the function's source also for optimized frames

Review URL: https://codereview.chromium.org/1186823003

Cr-Commit-Position: refs/heads/master@{#29082}

Now that the graph is being trimmed after generic lowering, we can drop
this workaround. The diamond will no longer confuse the scheduler.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1191913002

Cr-Commit-Position: refs/heads/master@{#29081}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1181013011

Cr-Commit-Position: refs/heads/master@{#29080}

This fixes a bug where new-space GC could be triggered by non-folded allocations for some of the in-object properties, while the object was only partially initialized.

BUG=chromium:500497
LOG=y
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1182113007

Cr-Commit-Position: refs/heads/master@{#29079}

TEST==mjsunit/asm/double-lo
BUG=

Review URL: https://codereview.chromium.org/1170923004

Cr-Commit-Position: refs/heads/master@{#29078}

Up until now that was still mixed with control reduction in the
ControlReducer. This separation allows us to remove the horrible
Reducer::Finish hack and also do graph trimming at more appropriate
places in the pipeline (i.e. trim dead nodes after generic lowering,
which can also make nodes dead).

R=jarin@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1188433010

Cr-Commit-Position: refs/heads/master@{#29077}

I found after upgrading from 4.2.2 where apinatives.js still
existed to 4.4.56 where everything had been converted to C++ in
api-natives.cc, my constructors for ObjectTemplate instantiated objects
were no longer being called.  After investigation, I noticed in
apinatives.js that a new call would handle that, but there was no
corresponding constructor call in api-natives.cc (or anywhere else
along the chain of InstantiateObject), so I added a call to
Execution::Call to actually construct the object.  Forgive me if that
isn't the right place to add it (InitializeBody in objects-inl.h also
looked like a good place), or if there's a reason constructors are
not being called.

I also added myself to the AUTHORS file in this CL.

Review URL: https://codereview.chromium.org/1137693003

Cr-Commit-Position: refs/heads/master@{#29076}

BUG=chromium:479528
LOG=n

Review URL: https://codereview.chromium.org/1185373004

Cr-Commit-Position: refs/heads/master@{#29075}

BUG=chromium:500173
LOG=n

Review URL: https://codereview.chromium.org/1194513003

Cr-Commit-Position: refs/heads/master@{#29074}

Cr-Commit-Position: refs/heads/master@{#29073}

BUG=chromium:491907,chromium:499815
LOG=NO

Review URL: https://codereview.chromium.org/1180203003

Cr-Commit-Position: refs/heads/master@{#29072}

The remaining uses need some non-mechanical work:

  * non-standard-layout type, probably due to mixed access control

  * extended field designators

Review URL: https://codereview.chromium.org/1173343006

Cr-Commit-Position: refs/heads/master@{#29071}

Revert of Add %TypedArray% to proto chain (patchset #6 id:100001 of https://codereview.chromium.org/1186733002/)

Reason for revert:
[Sheriff] Changes layout tests:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/429

See e.g.:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/429/layout-test-results/inspector/console/console-big-array-pretty-diff.html

Please upload a blink side needsmanualrebaseline change first for these tests if the change is intended. Please also add a blink trybot on a reland of this CL.

Original issue's description:
> Add %TypedArray% to proto chain
>
> According to the ES6 spec, the main methods and getters shouldn't
> be properties of the individual TypedArray objects and prototypes
> but instead on %TypedArray% and %TypedArray%.prototype. This
> difference is observable through introspection. This patch moves
> some methods and getters to the proper place, with the exception
> of %TypedArray%.prototype.subarray and harmony methods. These will
> be moved in follow-on patches.
>
> BUG=v8:4085
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/a10590158260737b256fac3254b4939f48f90095
> Cr-Commit-Position: refs/heads/master@{#29057}

TBR=adamk@chromium.org,arv@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4085

Review URL: https://codereview.chromium.org/1192433003

Cr-Commit-Position: refs/heads/master@{#29070}