Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177083003

Cr-Commit-Position: refs/heads/master@{#28987}

Cr-Commit-Position: refs/heads/master@{#28986}

BUG=none
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1179053004

Cr-Commit-Position: refs/heads/master@{#28985}

R=yangguo@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1184493003

Cr-Commit-Position: refs/heads/master@{#28984}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1184693002.

Cr-Commit-Position: refs/heads/master@{#28983}

Cr-Commit-Position: refs/heads/master@{#28982}

Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1182513002/)

Reason for revert:
[Sheriff] Speculative revert for changing layout tests:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/379/layout-test-results/results.html

Exact blame assignment is not possible as our blink bots were in a bad state for a few builds.

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> BUG=N
> LOG=N
> R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/4e2a673881c55a13124dd62f2d05c8d9fe233cd3
> Cr-Commit-Position: refs/heads/master@{#28968}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186463002

Cr-Commit-Position: refs/heads/master@{#28981}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181123002

Cr-Commit-Position: refs/heads/master@{#28980}

Revert of Keep track of array buffers in new space separately (patchset #4 id:60001 of https://codereview.chromium.org/1133773002/)

Reason for revert:
GC stress unhappy

Original issue's description:
> Keep track of array buffers in new space separately
>
> BUG=v8:3996
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/506397d0a4241c19f5fab890e49e22d1d9b28bdc
> Cr-Commit-Position: refs/heads/master@{#28978}

TBR=hpayer@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1178403003

Cr-Commit-Position: refs/heads/master@{#28979}

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1133773002

Cr-Commit-Position: refs/heads/master@{#28978}

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179893003

Cr-Commit-Position: refs/heads/master@{#28977}

Before selecting multiply-accumulate for a multiplication with add operation,
check that the multiply can't be reduced to add-with-shift. This prevents
simple multiplications by 3, 5, etc turning into register moves and madd
instructions.

Review URL: https://codereview.chromium.org/1180863002

Cr-Commit-Position: refs/heads/master@{#28976}

This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}

Rolling v8/tools/clang to 8b3ed2cb2e2512fa1074043cea3ada1143b80f26

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1179113002

Cr-Commit-Position: refs/heads/master@{#28974}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178123003

Cr-Commit-Position: refs/heads/master@{#28973}

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}

When setting a property using `super.prop = val` we need to use
add property if we are adding a new property and not set property.

BUG=493566
LOG=N
R=verwaest@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1161073002

Cr-Commit-Position: refs/heads/master@{#28971}

BUG=v8:4137
LOG=n
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1179983002.

Cr-Commit-Position: refs/heads/master@{#28970}

%AddElement is not intended for objects which are not arrays, and
its behavior may go away with future refactorings. This patch gets
rid of it if the receiver of from or of is not the intrinsic Array
object.

Array.of and Array.from previously papered over failures in calling
[[DefineOwnProperty]] when setting array elements. This patch
makes them lead to exceptions, and adds tests to assert that
the appropriate exceptions are thrown.

BUG=v8:4168
R=adamk
CC=rossberg,verwaest
LOG=Y

Review URL: https://codereview.chromium.org/1181623003

Cr-Commit-Position: refs/heads/master@{#28969}

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

BUG=N
LOG=N
R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1182513002

Cr-Commit-Position: refs/heads/master@{#28968}

Reland of Use the LookupIterator in SetAccessor (patchset #1 id:1 of https://codereview.chromium.org/1175323004/)

Reason: Didn't break anything

Original issue's description:
> Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
>
> Reason for revert:
> Blocks reverting of https://codereview.chromium.org/1175973002
>
> Original issue's description:
> > Use the LookupIterator in SetAccessor
> >
> > BUG=v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> > Cr-Commit-Position: refs/heads/master@{#28955}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4137
>
> Committed: https://crrev.com/11dbd29de57b290ee8dac2a782a53f879beb416f
> Cr-Commit-Position: refs/heads/master@{#28956}

TBR=jkummerow@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181813002

Cr-Commit-Position: refs/heads/master@{#28967}

Revert of Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #1 id:1 of https://codereview.chromium.org/1179933002/)

Reason for revert:
Reland, this didn't break anything.

Original issue's description:
> Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)
>
> Reason for revert:
> It broke webkit_unit_tests
>
> Original issue's description:
> > Remove GetAttributes from the mix to avoid another virtual dispatch.
> >
> > BUG=chromium:495949,v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> > Cr-Commit-Position: refs/heads/master@{#28953}
>
> TBR=verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:495949,v8:4137
>
> Committed: https://crrev.com/ae639d2ad646237e2f413259a0f116845ef96440
> Cr-Commit-Position: refs/heads/master@{#28958}

TBR=ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1182603002

Cr-Commit-Position: refs/heads/master@{#28966}

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1173283004.

Cr-Commit-Position: refs/heads/master@{#28965}

The main motivation is simplifying profiling activities:

1) Use hex instead of decimal for offsets, just like perf does. This
affects --print-opt-code

2) When printing block information, indicate loop information: if
block is header, where the end is; if block is in a loop, where the
loop starts. This affects --code-comments.

Using --print-opt-code --code-comments, and cross-referencing with data
obtained from perf, one may now find the block a hotspot belongs to
without needing to do hex2dec/dec2hex conversions. Once found, loop info
is available locally, on the block.

BUG=

Review URL: https://codereview.chromium.org/1177123002

Cr-Commit-Position: refs/heads/master@{#28964}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177103003

Cr-Commit-Position: refs/heads/master@{#28963}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178083002

Cr-Commit-Position: refs/heads/master@{#28962}

BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1177263002

Cr-Commit-Position: refs/heads/master@{#28960}

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178953003.

Cr-Commit-Position: refs/heads/master@{#28959}

Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}

@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1175973002

Cr-Commit-Position: refs/heads/master@{#28953}

port dd854449 (r28839)

original commit message:

    Boolean "is_strong" parameters have begun to proliferate across areas where
    strong mode semantics are different. This CL repurposes the existing
    ObjectStrength enum as a replacement for them.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173973002

Cr-Commit-Position: refs/heads/master@{#28952}

port b27016b7 (r28827).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1178533002

Cr-Commit-Position: refs/heads/master@{#28951}

port bd32a9f7 (r28825).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173963002

Cr-Commit-Position: refs/heads/master@{#28950}

port 345fa142 (r28802).

    port of r28769 overwrite some of r28802 so we port them again.

original commit message:

    Before this we had 3 super related lexical bindings that got injected
    into method bodies: .home_object, .this_function,  and new.target.
    With this change we get rid of the .home_object one in favor of using
    .this_function[home_object_symbol] which allows some simplifications
    throughout the code base.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173933005

Cr-Commit-Position: refs/heads/master@{#28949}

port e4782a9b (r28782)

original commit message:

    Previously the %_DateField intrinsic would also check the object and
    throw an exception if you happen to pass something that is not a valid
    JSDate, which (a) violates our policy for instrinsics and (b) is hard to
    optimize in TurboFan (even Crankshaft has a hard time, but there we will
    never inline the relevant builtins, so it doesn't show up). The throwing
    part is now a separate intrinsics %_ThrowIfNotADate that throws an
    exception in full codegen and deoptimizes in Crankshaft, which means the
    code for the current use cases is roughly the same (modulo some register
    renamings/gap moves).

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1174913002

Cr-Commit-Position: refs/heads/master@{#28948}