The debugger calls PromiseHasUserDefinedRejectHandler to recursively search the
tree of dependent promises for user-defined reject handlers. If no such reject
handler exists, rejecting the promise is considered an uncaught exception.

Promise.race and Promise.all interupt the link of promise dependency wrt the
search. This change fixes that link.

R=rossberg@chromium.org
BUG=chromium:439585
LOG=N

Review URL: https://codereview.chromium.org/1411083003

Cr-Commit-Position: refs/heads/master@{#31392}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1416663004

Cr-Commit-Position: refs/heads/master@{#31391}

R=littledan@chromium.org
BUG=v8:4342
LOG=Y

Review URL: https://codereview.chromium.org/1412133002

Cr-Commit-Position: refs/heads/master@{#31390}

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414173002 .

Cr-Commit-Position: refs/heads/master@{#31389}

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1415843002 .

Cr-Commit-Position: refs/heads/master@{#31388}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1406963004

Cr-Commit-Position: refs/heads/master@{#31387}

This stages the general purpose inlining mechanism in TurboFan and also
disables the remaining tests that still fail. We do this to get test
coverage early and to avoid regressing inlining as we go along.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412703002

Cr-Commit-Position: refs/heads/master@{#31386}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413183002

Cr-Commit-Position: refs/heads/master@{#31385}

Port e678a0f9

Original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412153003

Cr-Commit-Position: refs/heads/master@{#31384}

During eviction of FreeSpace nodes that reside on eviction pages we iterate
throug the list node-by-node, unlinking only those that reside on eviction
pages. We failed to properly update end_ if nodes were evicted are encountering
nodes that that are left as is.

BUG=chromium:539356
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411263002

Cr-Commit-Position: refs/heads/master@{#31383}

BUG=v8:1306
LOG=Y

Review URL: https://codereview.chromium.org/1411053002

Cr-Commit-Position: refs/heads/master@{#31382}

Re-land of https://crrev.com/cf13dda1ba25e8293ea143f33c6c5f6233a39c86,
fixing the issue with vector stores.

Class methods always have the class scope on their scope chain in order
to implement strong mode checks. Previously, that scope wasn't attached
to the ClassLiteral for anonymous classes (since the scope contained
no bindings).

This patch simply puts that same scope on the ClassLiteral, anonymous
or not, which simplifies other code that needs to reason about the scope
of a class and its methods.

Review URL: https://codereview.chromium.org/1418433002

Cr-Commit-Position: refs/heads/master@{#31381}

This is exactly what it looks like. A temporary hack that ensures we
can make forward progress with the JSInliner despite other components
have a hard time picking the correct zone. This hack is a hack!

R=bmeurer@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1410963003

Cr-Commit-Position: refs/heads/master@{#31380}

Should already work according to issue.

BUG=chromium:424619
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1413913002

Cr-Commit-Position: refs/heads/master@{#31379}

Separately collect element keys from property keys to avoid slow
corner-cases. Partly deal with keys generated by Proxies.

BUG=chromium:536790
LOG=N

Review URL: https://codereview.chromium.org/1397063002

Cr-Commit-Position: refs/heads/master@{#31378}

This adds a test case that ensures calling Debug.scripts without any
listener attached fails gracefully. For now we are throwing the string
"illegal access", this might change in the future to be a dedicated
exception.

R=yangguo@chromium.org
TEST=mjsunit/debug-scripts-throw

Review URL: https://codereview.chromium.org/1411193002

Cr-Commit-Position: refs/heads/master@{#31377}

Fix after https://codereview.chromium.org/1413023002/

BUG=chromium:535160
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1411973003

Cr-Commit-Position: refs/heads/master@{#31376}

This fixes a small inconsistency when the accessor is on a prototype,
because the property access has to respect the holder (and not always go
to the receiver unconditionally).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1409273005

Cr-Commit-Position: refs/heads/master@{#31375}

Cr-Commit-Position: refs/heads/master@{#31374}

Revert of Always give class literals a block scope (patchset #2 id:20001 of https://codereview.chromium.org/1413903002/ )

Reason for revert:
[Sheriff] Breaks vector stores:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20vector%20stores/builds/536

Original issue's description:
> Always give class literals a block scope
>
> Class methods always have the class scope on their scope chain in order
> to implement strong mode checks. Previously, that scope wasn't attached
> to the ClassLiteral for anonymous classes (since the scope contained
> no bindings).
>
> This patch simply puts that same scope on the ClassLiteral, anonymous
> or not, which simplifies other code that needs to reason about the scope
> of a class and its methods.
>
> Committed: https://crrev.com/cf13dda1ba25e8293ea143f33c6c5f6233a39c86
> Cr-Commit-Position: refs/heads/master@{#31371}

TBR=mstarzinger@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1416583002

Cr-Commit-Position: refs/heads/master@{#31373}

Review URL: https://codereview.chromium.org/1412153002

Cr-Commit-Position: refs/heads/master@{#31372}

Class methods always have the class scope on their scope chain in order
to implement strong mode checks. Previously, that scope wasn't attached
to the ClassLiteral for anonymous classes (since the scope contained
no bindings).

This patch simply puts that same scope on the ClassLiteral, anonymous
or not, which simplifies other code that needs to reason about the scope
of a class and its methods.

Review URL: https://codereview.chromium.org/1413903002

Cr-Commit-Position: refs/heads/master@{#31371}

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1411213002

Cr-Commit-Position: refs/heads/master@{#31370}

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1411693004

Cr-Commit-Position: refs/heads/master@{#31369}

LOG=N
R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1415533004

Cr-Commit-Position: refs/heads/master@{#31368}

BUG=v8:4499
LOG=n
NOTRY=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1411203003

Cr-Commit-Position: refs/heads/master@{#31367}

Adds support for throwing exceptions. Adds the bytecode Throw.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410863002

Cr-Commit-Position: refs/heads/master@{#31366}

This adds support to also optimize loads from special JSObject field
accessors, like String::length and JSArray::length.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417503002

Cr-Commit-Position: refs/heads/master@{#31365}

BUG=v8:4499
LOG=n
NOTRY=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1411933003

Cr-Commit-Position: refs/heads/master@{#31364}

Depends on https://codereview.chromium.org/1413023002/

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1414713002

Cr-Commit-Position: refs/heads/master@{#31363}

The dispatcher failed to MISS properly when configured as a monomorphic
keyed string store, causing a crash.

BUG=v8:4495
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1415533003

Cr-Commit-Position: refs/heads/master@{#31362}

Cr-Commit-Position: refs/heads/master@{#31361}

The test suite is ran in 60% of the bots anyway and the
step is very short. For swarming, it's better to run this
together in one step as each step triggers a different bot.

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413023002

Cr-Commit-Position: refs/heads/master@{#31360}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1411143002

Cr-Commit-Position: refs/heads/master@{#31359}

Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
that supports a fast path for small integers. Everything else is still
handled in the runtime.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412963002

Cr-Commit-Position: refs/heads/master@{#31358}

[IC] Ensure we don't transition receivers when there's a data property in the hidden prototype chain.

BUG=chromium:542647
R=cbruni@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1406873002

Cr-Commit-Position: refs/heads/master@{#31357}

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410353002

Cr-Commit-Position: refs/heads/master@{#31356}

This removes all locally constructed SimplifiedOperatorBuilder instances
and uses the one passed along the JSGraph. It ensures that the correct
zone is used to allocate operators, no matter where the reducer is used.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410003002

Cr-Commit-Position: refs/heads/master@{#31355}

The typer can infer true/false for ObjectIsSmi if the argument has a
fixed/known representation (i.e. is either known to be smi or heap
object).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1412673003

Cr-Commit-Position: refs/heads/master@{#31354}

This introduces an explicit lazy bailout. It is wrapped in the call
node, mostly because the lazy deoptimization processing is married
to the call processing in the instruction selector and the code generator.

It is still a terrible hack.

R=bmeurer@chromium.org,mstarzinger@chromium.org
BUG=chromium:543994,v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1412443003

Cr-Commit-Position: refs/heads/master@{#31353}