port cb9b8010 (r33582)

  original commit message:
  The previous versions of Math.max and Math.min made it difficult to
  optimize those (that's why we already have custom code in Crankshaft),
  and due to lack of ideas what to do about the variable number of
  arguments, we will probably need to stick in special code in TurboFan
  as well; so inlining those builtins is off the table, hence there's no
  real advantage in having them around as "not quite JS" with extra work
  necessary in the optimizing compilers to still make those builtins
  somewhat fast in cases where we cannot inline them (also there's a
  tricky deopt loop in Crankshaft related to Math.min and Math.max, but
  that will be dealt with later).

  So to sum up: Instead of trying to make Math.max and Math.min semi-fast
  in the optimizing compilers with weird work-arounds support %_Arguments
  %_ArgumentsLength, we do provide the optimal code as native builtins
  instead and call it a day (which gives a nice performance boost on some
  benchmarks).

BUG=

Review URL: https://codereview.chromium.org/1659623003

Cr-Commit-Position: refs/heads/master@{#33652}

Based on vogelheim's CL at https://codereview.chromium.org/1657783002/

BUG=chromium:582626, v8:2700
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1656993002

Cr-Commit-Position: refs/heads/master@{#33651}

This patch adds a UseCounter for each of the following:
- Allowing duplicate sloppy-mode block-scoped function declarations
  in the exact same scope
- for-in loops with an initializer

The patch also refactors some of the declaration code to clean it up and
enable the first counter, and adds additional unit tests to nail down
the semantics of edge cases of sloppy-mode block-scoped function declarations.

BUG=v8:4693,chromium:579395
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1633743003

Cr-Commit-Position: refs/heads/master@{#33650}

Improved flexibility for the perf runner, by adding option to
specify precisely shell binary.

NOTRY=true

Review URL: https://codereview.chromium.org/1659483003

Cr-Commit-Position: refs/heads/master@{#33649}

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1659503002

Cr-Commit-Position: refs/heads/master@{#33648}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1654973002 .

Cr-Commit-Position: refs/heads/master@{#33647}

BUG=v8:4639
LOG=n
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/1653103002 .

Cr-Commit-Position: refs/heads/master@{#33646}

R=adamk

Review URL: https://codereview.chromium.org/1637103002

Cr-Commit-Position: refs/heads/master@{#33645}

Make it possible to switch on simd.js support when combined with asm.js
in the asm->wasm path.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=gdeepti@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1643333002

Cr-Commit-Position: refs/heads/master@{#33644}

A class's name is its constructor's name, so there's no need to treat it separately,
either in the parser or in code generation. The main parser use of the name is
for ES2015 Function.name handling, and this patch also cleans up handling there
by adding a new IsAnonymousFunctionDefinition() method to Expression (the name
comes from the spec).

Also removed unused ParserTraits::DefaultConstructor method.

BUG=v8:3699
LOG=n

Review URL: https://codereview.chromium.org/1647213002

Cr-Commit-Position: refs/heads/master@{#33643}

In the interest of generalization, this change:
- Consolidates cache line size detection for all interested
  architectures under base::CPU (currently leveraged by only
  PPC and ARM64).
- Differentiates between instruction vs data cache line sizes.

R=rmcilroy@chromium.org, jochen@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1643363002

Cr-Commit-Position: refs/heads/master@{#33642}

The runtime call to Runtime::kReThrow does not need a frame-state node
attached, the frame-state input count is zero. This restructures the
graph builder to not instantiate a FrameStateBeforeAndAfter for it.

R=jarin@chromium.org
TEST=cctest/test-run-bytecode-graph-builder
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1654833002

Cr-Commit-Position: refs/heads/master@{#33641}

R=jochen@chromium.org
BUG=chromium:577261
LOG=N

Review URL: https://codereview.chromium.org/1655853002

Cr-Commit-Position: refs/heads/master@{#33640}

The notion of an unreachable environment is useful for a recursive
descent iteration (e.g. over an AST) where nodes are created on the
ascent path as well. For a flat iteration (e.g. over bytecode stream)
environments become unreachable at the end of a visitation function.
Hence any unreachable path can be represented by nulling the tracked
environment completely. This further reduces the number of redundant
nodes being created.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1650483003

Cr-Commit-Position: refs/heads/master@{#33639}

Set the bytecode array correctly in Runtime_SetCode.
This fixes issues with building the snapshot with ignition enabled.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1647913002

Cr-Commit-Position: refs/heads/master@{#33638}

This reverts a small part of e709aa24 in an attempt to recover
lost page_cycler performance.

R=jkummerow@chromium.org
BUG=chromium:580973
LOG=N

Review URL: https://codereview.chromium.org/1651073002

Cr-Commit-Position: refs/heads/master@{#33637}

  Although x87 has 8 registers, it use only 1 double register in TurboFan code generation for some limitations.

  So for TestStackSlot() function, use the num_allocatable_double_registers() to check the avaliable double registers
  of TurboFan is more suitable than num_double_registers().

BUG=

Review URL: https://codereview.chromium.org/1653913002

Cr-Commit-Position: refs/heads/master@{#33636}

This simplifies the branch analysis we perform on the bytecode stream
down to the bare minimum that we need to build graphs. Note that we
still record all branch targets, even though only the backwards ones
would be needed, but this is essentially for free and might be useful
eventually.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1646873004

Cr-Commit-Position: refs/heads/master@{#33635}

The reachability of a bytecode is implied by a live environment reaching
the bytecode during the abstract control flow simulation of the bytecode
iteration perfromed by the graph builder. There is no need to compute it
upfront anymore.

Also, the upfront computation was only an approximation when it came to
the reachability of an exception handler. This is why several tests for
translation of exception handlers can now be enabled.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1645293003

Cr-Commit-Position: refs/heads/master@{#33634}

This simplifies how the BytecodeGraphBuilder simulates control flow by
reversing the propagation direction to forwards propagation. This is the
same direction as the data flow which is also a forward propagation. In
this way the analysis information needed at merge points is drastically
reduced while still retaining the same simulation power.

In short: We push down environments instead of pulling them.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1641893004

Cr-Commit-Position: refs/heads/master@{#33633}

NonPatternRewrite was called more than once for the same AST
in the case of (computed) key expressions present in object
literals.  As an example, in:

   var x = { [[...42]]: 17 };

the array containing the spread would be desugared first and
then the resulting do-expression would again be desugared.

This could be problematic if a computed key expression contains
large nested array/object literals.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1645023002

Cr-Commit-Position: refs/heads/master@{#33632}

The root register is needed (at least on x64) to access
ExternalReferences.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1641153003

Cr-Commit-Position: refs/heads/master@{#33631}

 The CL #33347 (https://codereview.chromium.org/1589363002) added the RunRoundInt32ToFloat32 test case and X87 failed at it.

 The reason is same as the CL #31808 (issue 1430943002, X87: Change the test case for X87 float operations), please refer: https://codereview.chromium.org/1430943002/.

 Here is the key comments from CL #31808
 Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function,
 those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
 The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
 The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

 For CHECK_EQ(a, b) function, if a and b are doubles, it will has similar behaviors like CheckFloatEq(...) and CheckDoubleEq(...) function when compiled by GCC and causes the test case
 fail.

 So we add the following sentence to do type case to keep the same precision for RunRoundInt32ToFloat32. Such as: volatile double expect = static_cast<float>(*i).

BUG=

Review URL: https://codereview.chromium.org/1649323002

Cr-Commit-Position: refs/heads/master@{#33630}

This patch ships the first part of RegExp subclassing--defining
Symbol.{match,replace,search,split}, but keeping their original
definitions which are restricted to a RegExp receiver and do not
call out to the core 'exec' method. This is being shipped separately
because the two sets of extension points are separate features with
separate functionality. The amount of behavior which is held behind
the flag is very small, just exposing the symbols as properties of
Symbol--the behavior that the String methods call out to these Symbol
properties has already been shipping unflagged.

R=yangguo@chromium.org
BUG=v8:4305,v8:4343,v8:4344,v8:4345
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1652793002

Cr-Commit-Position: refs/heads/master@{#33629}

TBR=brucedawson@chromium.org

Review URL: https://codereview.chromium.org/1655743002

Cr-Commit-Position: refs/heads/master@{#33628}

In the debugger we are interested in getting the context for the
current frame, which is usually a function context. To do that,
we used to call Context::declaration_context, which may also
return a block context. This is wrong and can lead to crashes.
Instead, we now use a newly introduced Context::closure_context,
which skips block contexts. This works fine for the debugger,
since we have other means to find and materialize block contexts.

R=rossberg@chromium.org
BUG=chromium:582051
LOG=N

Review URL: https://codereview.chromium.org/1648263002

Cr-Commit-Position: refs/heads/master@{#33627}

Rolling v8/tools/clang to 667833c8778efe12d3d749f5f5dfd4b10a1388a0

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1651003002

Cr-Commit-Position: refs/heads/master@{#33626}

Rolling v8/tools/clang to f1b8960790c46bf022d178a85a88210a7b10a2a5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1652723002

Cr-Commit-Position: refs/heads/master@{#33625}

Rolling v8/base/trace_event/common to 3b14e6554b07defdad00c17d162c6e7121f71fbf

Rolling v8/buildtools to 389b7143dbd63da3a9725e304d286b02805fc170

Rolling v8/tools/clang to 7548b22debe829cb92047725def34c50fb88ca01

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1648343004

Cr-Commit-Position: refs/heads/master@{#33624}

On further reflection, marking the variable proxy at call sites
for foreign functions as a function is ok. Switching this.

Fixed a few IntersectResults that probably should be an explicit set_bounds.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1656493002

Cr-Commit-Position: refs/heads/master@{#33623}

Associate a type with foreign functions at their callsite.
Associate a type with foreign variables.
More pervasively forbid computation in the module body.
Confirm foreign call arguments are exports.

Pass zone to more Type constructors, for consistency.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1643003004

Cr-Commit-Position: refs/heads/master@{#33622}

BUG=581960
LOG=N

Review URL: https://codereview.chromium.org/1642143004

Cr-Commit-Position: refs/heads/master@{#33621}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1650593002

Cr-Commit-Position: refs/heads/master@{#33620}

StoreP needs a scratch register for unaligned immediate offset.

R=neis@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4700
LOG=n

Review URL: https://codereview.chromium.org/1644863005

Cr-Commit-Position: refs/heads/master@{#33619}

Port cb9b8010

Original commit message:
    The previous versions of Math.max and Math.min made it difficult to
    optimize those (that's why we already have custom code in Crankshaft),
    and due to lack of ideas what to do about the variable number of
    arguments, we will probably need to stick in special code in TurboFan
    as well; so inlining those builtins is off the table, hence there's no
    real advantage in having them around as "not quite JS" with extra work
    necessary in the optimizing compilers to still make those builtins
    somewhat fast in cases where we cannot inline them (also there's a
    tricky deopt loop in Crankshaft related to Math.min and Math.max, but
    that will be dealt with later).

    So to sum up: Instead of trying to make Math.max and Math.min semi-fast
    in the optimizing compilers with weird work-arounds support %_Arguments
    %_ArgumentsLength, we do provide the optimal code as native builtins
    instead and call it a day (which gives a nice performance boost on some
    benchmarks).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1648353002

Cr-Commit-Position: refs/heads/master@{#33618}

Port 0637f5f6

Original commit message:
    If we deoptimize from TurboFan or Crankshaft into the body of a for-in
    loop and that for-in mode then switches to slow mode (i.e. has to call
    %ForInFilter), we have to record that feedback, because otherwise we
    might actually OSR into that loop assuming that it's fast mode still,
    or even worse recompile the function later when we call it again w/o
    having rerun the for-in loop in fullcodegen from the beginning (where
    was previously the only place we could learn).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:3650
LOG=n

Review URL: https://codereview.chromium.org/1644383002

Cr-Commit-Position: refs/heads/master@{#33617}

String wrappers (new String("foo")) are special objects: their string
characters are accessed like elements, and they also have an elements
backing store. This used to require a bunch of explicit checks like:

if (obj->IsJSValue() && JSValue::cast(obj)->value()->IsString()) {
  /* Handle string characters */
}
// Handle regular elements (for string wrappers and other objects)
obj->GetElementsAccessor()->Whatever(...);

This CL introduces new ElementsKinds for string wrapper objects (one for
fast elements, one for dictionary elements), which allow folding the
special-casing into new StringWrapperElementsAccessors.

No observable change in behavior is intended.

Review URL: https://codereview.chromium.org/1612323003

Cr-Commit-Position: refs/heads/master@{#33616}

Revert of [runtime] further dismantle AccessorInfoHandling, reducing it to the single API usecase. (patchset #2 id:20001 of https://codereview.chromium.org/1643563002/ )

Reason for revert:
[Sheriff] Speculative revert for breaking webkit unit tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/4251

Original issue's description:
> [runtime] further dismantle AccessorInfoHandling, reducing it to the single API usecase.
>
> BUG=
>
> Committed: https://crrev.com/85aba7df84d397c7e47537292e6895bd8b26f440
> Cr-Commit-Position: refs/heads/master@{#33613}

TBR=ishell@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1650033003

Cr-Commit-Position: refs/heads/master@{#33615}

Previously, String.prototype.normalize constructed its ICU input
string as a null-terminated string. This creates a bug for strings
which contain a null byte, which is allowed in ECMAScript. This
patch constructs the ICU string based on its length so that the
entire string is normalized.

R=jshin@chromium.org
BUG=v8:4654
LOG=Y

Review URL: https://codereview.chromium.org/1645223003

Cr-Commit-Position: refs/heads/master@{#33614}

BUG=

Review URL: https://codereview.chromium.org/1643563002

Cr-Commit-Position: refs/heads/master@{#33613}