When enabling the v8 profiler (Using the following command parameters: --js-flags=--prof)
   or vtune profiling in chromium. it will break. This failure is introduced by this CL:
   https://codereview.chromium.org/1218863002.

   The reason is that V8 will enable the JITted code logging if --prof is set for V8. And under
   this condition, the function Logger::LogCodeObjects() will be invoked and it will trigger a
   mark-compact GC when deserializing the snapshot. This GC will use MemoryReducer to post a
   delay task by invoking V8Platform::CallDelayedOnForegroundThread() function. But at this point
   V8 isolation is still under initialization and the PerIsolationData of this isolation has not
   been created. (isolation_holder.cc:39~40 line). This leads to V8Platform::CallDelayedOnForegroundThread()
   failure because of segment fault.

   According to my understanding, I proposed the following fix. If the heap deserialization has not
   be completed, it does not post the delay task for next GC.

BUG=

Review URL: https://codereview.chromium.org/1270493002

Cr-Commit-Position: refs/heads/master@{#29937}

This fix makes the redirect mechanism a bit more stable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1269733002

Cr-Commit-Position: refs/heads/master@{#29936}

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1258923010

Cr-Commit-Position: refs/heads/master@{#29935}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1257543003

Cr-Commit-Position: refs/heads/master@{#29934}

Pass the kGCCallbackFlagForced flag when invoking Heap::CollectAllGarbage from AdjustAmountOfExternalAllocatedMemory.

This forces the second pass of the pending phantom callbacks to run immediately after the first.

BUG=chromium:511294
LOG=Y

Review URL: https://codereview.chromium.org/1252993004

Cr-Commit-Position: refs/heads/master@{#29933}

TBR=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1263633003

Cr-Commit-Position: refs/heads/master@{#29932}

This is the first step in cutting the Gordian linkage/linkage-impl knot.

This basically changes the axis along which we organize call descriptor
building logic from having platform-specific files dedicated to all call
descriptor types to having call-descriptor-type-specific files that have

The next step is to factor the JS, code stub, and runtime call descriptors
similarly, dumping them into:
  compiler/js-linkage.cc
  compiler/runtime-linkage.cc
  compiler/code-stub-linkage.cc

 or, alternatively, all of them just into compiler/js-linkage.cc.

This also anticipates a wasm-linkage.cc file in the future.

R=bmeurer@chromium.org,danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1266603002

Cr-Commit-Position: refs/heads/master@{#29931}

BUG=chromium:454297
LOG=n

Review URL: https://codereview.chromium.org/1265943002

Cr-Commit-Position: refs/heads/master@{#29930}

Adds interpreter entry and exit trampoline builtins. Also implements the
Return bytecode handler and fixes a few bugs in InterpreterAssembler
highlighted by running on other architectures.

MIPS and MIPS64 port contributed by Paul Lind (paul.lind@imgtec.com)

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1245133002

Cr-Commit-Position: refs/heads/master@{#29929}

Looks like this:
--- AST ---
FUNC
. NAME "foo"
. INFERRED NAME ""
. RETURN
. . PROPERTY ICSlot(0, LOAD_IC)
. . . VAR PROXY ICSlot(1, LOAD_IC) (mode = DYNAMIC_GLOBAL) "a"
. . . NAME x

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1264823003

Cr-Commit-Position: refs/heads/master@{#29928}

BUG=v8:4331
LOG=N

Review URL: https://codereview.chromium.org/1263763002

Cr-Commit-Position: refs/heads/master@{#29927}

The idle time handler should never return DONE or DO_SCAVENGE for
background tabs. Upon receiving DONE chrome will stop sending idle notifications.

BUG=chromium:515174
LOG=NO

Review URL: https://codereview.chromium.org/1269583002

Cr-Commit-Position: refs/heads/master@{#29926}

This avoids multiple ToFastProperties runtime calls and additional stack
pushes in strong mode.

BUG=

Review URL: https://codereview.chromium.org/1266573003

Cr-Commit-Position: refs/heads/master@{#29925}

When a Property or a VariableProxy is used as the left hand side of an
assignment statement, there is no need to allocate a LOAD_IC feedback
vector slot for it. Alter the numbering phase to support this.

BUG=

Review URL: https://codereview.chromium.org/1262803002

Cr-Commit-Position: refs/heads/master@{#29924}

All runtime function get a context anyway, which is the same as the
explicit one in case of DeclareGlobals and DeclareLookupSlot. So
we can remove the additional parameter there.

As an additional bonus, improve the runtime interface to DeclareLookupSlot.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1261863002

Cr-Commit-Position: refs/heads/master@{#29923}

R=mvstanton@chromium.org
BUG=v8:4333
LOG=N

Review URL: https://codereview.chromium.org/1264603002

Cr-Commit-Position: refs/heads/master@{#29922}

Adapted disassembler for J and JAL instructions.

TEST=cctest/test-disasm-mips/Type0,
     cctest/test-disasm-mips64/Type3
BUG=

Review URL: https://codereview.chromium.org/1258743004

Cr-Commit-Position: refs/heads/master@{#29921}

Replaces the 64-bit div instruction with 32-bit division in DivI.
Also fixes the Ddiv implementation in the simulator.

TEST=mjsunit/asm/int32div
BUG=

Review URL: https://codereview.chromium.org/1265603002

Cr-Commit-Position: refs/heads/master@{#29920}

A Parameter operator contains a ParameterInfo payload, not an int
payload, so the OpParameter<int> cast is invalid (and only worked by
coincidence currently).

BUG=chromium:515215
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1266743002

Cr-Commit-Position: refs/heads/master@{#29919}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1262613002

Cr-Commit-Position: refs/heads/master@{#29918}

This fixes several bugs related to float64 pool constants.

Note that float64 pool constants are still disabled by default, and are
only used if --enable-vldr-imm is provided.

BUG=

Review URL: https://codereview.chromium.org/1260953002

Cr-Commit-Position: refs/heads/master@{#29917}

This has become possible since we moved a few experimental
Javascript features to default.

R=hpayer@chromium.org
BUG=chromium:506044
LOG=N

Review URL: https://codereview.chromium.org/1262833002

Cr-Commit-Position: refs/heads/master@{#29916}

Reland^3 "Enable loads and stores to global vars through property cell shortcuts installed into par… (patchset #1 id:1 of https://codereview.chromium.org/1254723004/)"

This reverts commit 2c16d81b.

R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1261533004 .

Cr-Commit-Position: refs/heads/master@{#29915}

TBR=jkummerow@chromium.org, hablich@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1258193003

Cr-Commit-Position: refs/heads/master@{#29914}

Moves some uncommon type checking from ToString and
NonStringToString into DefaultString. This should
speed up string operations.

LOG=N
BUG=none

Review URL: https://codereview.chromium.org/1256323004

Cr-Commit-Position: refs/heads/master@{#29913}

script_executed and last_run are read/written by multiple threads. Also
externalized_shared_contents_ is modified by multiple threads.

BUG=4306
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1252623003

Cr-Commit-Position: refs/heads/master@{#29912}

When the main thread terminates, it forcibly terminates all Worker threads.
When this happens, the threads objects were only half-created; they had a
JavaScript Worker object, but not a C++ worker object.

This CL fixes that bug, as well as some other fixes:
* Signatures on Worker methods
* Use SetAlignedPointerFromInternalField instead of using an External.
* Remove state_ from Worker. Simplify to atomic bool running_.

BUG=chromium:511880
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1255563002

Cr-Commit-Position: refs/heads/master@{#29911}

Changes the interpreter to use a BytecodeArray pointer and an offset to avoid
having an inner pointer to a BytecodeArray object in registers during dispatch.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1254293006

Cr-Commit-Position: refs/heads/master@{#29910}

1 << 24 is apparently not large enough for some optimized code.

R=jkummerow@chromium.org
BUG=v8:4272
LOG=N

Review URL: https://codereview.chromium.org/1265663002

Cr-Commit-Position: refs/heads/master@{#29909}

Moves some uncommon type checking from ToNumber and
NonNumberToNumber into DefaultNumber. This should
speed up numeric operations especially as more "value types
are added.

LOG=N
BUG=513196, v8:4124

Review URL: https://codereview.chromium.org/1260273002

Cr-Commit-Position: refs/heads/master@{#29908}

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1259723002

Cr-Commit-Position: refs/heads/master@{#29907}

Port 5dff4bdf

Original commit message:
    No need to pass the name explicitly to the stubs; the runtime can
    extract the name from the ScopeInfo (the extension of the
    ScriptContext) on-demand easily without any performance impact.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1258273002

Cr-Commit-Position: refs/heads/master@{#29906}

Revert^3 "Enable loads and stores to global vars through property cell shortcuts installed into par… (patchset #1 id:1 of https://codereview.chromium.org/1254723004/)

Reason for revert:
Suspected to cause Canary crashes

Original issue's description:
> Reland^2 "Enable loads and stores to global vars through property cell shortcuts installed into parent script context".
>
> This reverts commit 362b3785.
>
> R=ishell@chromium.org
>
> Committed: https://crrev.com/440ae014e56924b52337c3747221b79283f07b81
> Cr-Commit-Position: refs/heads/master@{#29849}

TBR=ishell@chromium.org,v8-mips-ports@googlegroups.com,plind44@gmail.com,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1260423002

Cr-Commit-Position: refs/heads/master@{#29905}

R=jkummerow@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1268463002

Cr-Commit-Position: refs/heads/master@{#29904}

Literals should stay together to simplify allocation folding. This CL takes the pretenuring information from the outermost literal and applies it to the inner liberals.

BUG=chromium:514721
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1263773002 .

Cr-Commit-Position: refs/heads/master@{#29903}

Rolling v8/buildtools to f0b8022601cf9c3c1a2f7efcea48e2fe81d3b143

TBR=machenbach@chromium.org
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1262733002

Cr-Commit-Position: refs/heads/master@{#29902}

BUG=
R=jkummerow@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1259013002

Cr-Commit-Position: refs/heads/master@{#29901}

BUG=chromium:511215
NOTREECHECKS=true
NOTRY=true
LOG=n
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1262113002

Cr-Commit-Position: refs/heads/master@{#29900}

This allows variants to be named on test failures (follow
up) and then to be used in the test runner for a repro.

This also speeds up variant iteration for test262 and fixes
a bug with variants for benchmarks.

BUG=chromium:511215
NOTREECHECKS=true
LOG=n

Review URL: https://codereview.chromium.org/1245623005

Cr-Commit-Position: refs/heads/master@{#29899}

When a prototype object migrates from a slow to a fast map, where the slow map
was registered as a user of its own prototype, then the registration must be
transferred to the new map (just like MigrateToMap does for all other cases).

BUG=chromium:513602
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263543004

Cr-Commit-Position: refs/heads/master@{#29898}