I noticed after reading a few GitHub comments that the information
about contributing to V8 is hard to find. I think it makes sense
to add this information to the README.

NOTRY=true
R=jochen@chromium.org, seththompson@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1342803004

Cr-Commit-Position: refs/heads/master@{#30730}

Remove incorrect usage of callee-saved FPU regs (f20 and above).
Also remove unnecessary push/pop which were occasionally unpaired,
and caused crash.

TEST=cctest/test-assembler-mips[64]
BUG=

Review URL: https://codereview.chromium.org/1338713004

Cr-Commit-Position: refs/heads/master@{#30729}

R=jarin
BUG=

Review URL: https://codereview.chromium.org/1340023003

Cr-Commit-Position: refs/heads/master@{#30728}

Revert of [crankshaft] Re-add fast-case for string add left/right. (patchset #1 id:1 of https://codereview.chromium.org/1339053002/ )

Reason for revert:
[Sheriff] Fails mozilla with deadcode:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20deadcode/builds/5357

Original issue's description:
> [crankshaft] Re-add fast-case for string add left/right.
>
> Now the StringAddStub can optionally convert it's parameters to strings
> (following the rules for the addition operator). This could be further
> optimized once we have a ToPrimitiveStub, but it should be sufficient
> for the moment.
>
> Also removed the unused Strength parameter to the HStringAdd operator,
> because string addition does not depend on language mode.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel,v8_linux_nosnap_dbg
> R=mstarzinger@chromium.org
> BUG=v8:4307
> LOG=n
>
> Committed: https://crrev.com/d261849e53fbf8c36efae42d478271f87acff70f
> Cr-Commit-Position: refs/heads/master@{#30726}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4307

Review URL: https://codereview.chromium.org/1347473003

Cr-Commit-Position: refs/heads/master@{#30727}

Now the StringAddStub can optionally convert it's parameters to strings
(following the rules for the addition operator). This could be further
optimized once we have a ToPrimitiveStub, but it should be sufficient
for the moment.

Also removed the unused Strength parameter to the HStringAdd operator,
because string addition does not depend on language mode.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1339053002

Cr-Commit-Position: refs/heads/master@{#30726}

Review URL: https://codereview.chromium.org/1333353005

Cr-Commit-Position: refs/heads/master@{#30725}

Rolling v8/buildtools to f7310ee61725e68b1c8921e381830362cf4f0999

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1342063002

Cr-Commit-Position: refs/heads/master@{#30724}

Filtering out functions does not allow sample processor
to figure out if a sample hit a non-frame region of a function.

The filtering should be done in the frontend.

BUG=chromium:529931
LOG=N

Review URL: https://codereview.chromium.org/1337743002

Cr-Commit-Position: refs/heads/master@{#30723}

Port eadfd666

Original commit message:
    The String constructor was somewhat complex with a lot of micro
    optimizations that are not relevant or even misguided. It would be
    really hard to port that code to ES6, which requires String to be
    subclassable. So as a first step we reduced the necessary complexity
    to the bare minimum (also removing the last user of the fairly complex
    MacroAssembler::LookupNumberStringCache method).

    This also removes the counters for the String constructor, which
    were not properly exposed anymore (and not kept in sync with inlined
    versions of the String constructor anyway).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1339143002

Cr-Commit-Position: refs/heads/master@{#30722}

Port e7fb2339

Original commit message:
    Adds support for JS calls to the interpreter. In order to support
    calls from the interpreter, the PushArgsAndCall builtin is added
    which pushes a sequence of arguments onto the stack and calls
    builtin::Call.

    Adds the Call bytecode.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1345543002

Cr-Commit-Position: refs/heads/master@{#30721}

Enhance the perf runner to run with the profiler and print the summary for each d8 run. This automates running the profiler with multiple benchmarks.

BUG=None
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1327033003

Cr-Commit-Position: refs/heads/master@{#30720}

Revert of VectorICs: ia32 store ics need a virtual register. (patchset #3 id:40001 of https://codereview.chromium.org/1336313002/ )

Reason for revert:
[Sheriff] Breaks GC stress on mac:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/2536

Original issue's description:
> VectorICs: ia32 store ics need a virtual register.
>
> Some pretty hacky code was used to carry out the tail-call
> handler dispatch on ia32 vector stores due to a lack
> of free registers. It really tanks performance. A better
> approach is to use a virtual register on the isolate.
>
> BUG=
>
> Committed: https://crrev.com/b26e98f19b5e77df50cb4a259f099ee6afa335e3
> Cr-Commit-Position: refs/heads/master@{#30718}

TBR=jkummerow@chromium.org,vogelheim@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1340123002

Cr-Commit-Position: refs/heads/master@{#30719}

Some pretty hacky code was used to carry out the tail-call
handler dispatch on ia32 vector stores due to a lack
of free registers. It really tanks performance. A better
approach is to use a virtual register on the isolate.

BUG=

Review URL: https://codereview.chromium.org/1336313002

Cr-Commit-Position: refs/heads/master@{#30718}

BUG=

Review URL: https://codereview.chromium.org/1341763002

Cr-Commit-Position: refs/heads/master@{#30717}

This prevents the internal objects-visiting.h to be usable outisde of
the "heap" directory. The static object visitation is only usefull
within the GC and is now properly encapsulated.

R=hpayer@chromium.org,mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1328003002

Cr-Commit-Position: refs/heads/master@{#30716}

BUG=

Review URL: https://codereview.chromium.org/1338983003

Cr-Commit-Position: refs/heads/master@{#30715}

Parallel compaction, i.e., concurrently moving of objects (and code) requires
proper synchronization in the logger.

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1338253002

Cr-Commit-Position: refs/heads/master@{#30714}

BUG=chromium:531322
LOG=N
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1337943005

Cr-Commit-Position: refs/heads/master@{#30713}

This moves scavenging functionality into a separate component so that
neither the scavenger nor objects-visiting need to be exposed outside
the heap.

R=hpayer@chromium.org,mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1323993004

Cr-Commit-Position: refs/heads/master@{#30712}

LOG=N

BUG=chromium:531348

Review URL: https://codereview.chromium.org/1344493004

Cr-Commit-Position: refs/heads/master@{#30711}

Adds support for JS calls to the interpreter. In order to support
calls from the interpreter, the PushArgsAndCall builtin is added
which pushes a sequence of arguments onto the stack and calls
builtin::Call.

Adds the Call bytecode.

MIPS port contributed by akos.palfi@imgtec.com in https://codereview.chromium.org/1334873002/

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1323463005

Cr-Commit-Position: refs/heads/master@{#30710}

BUG=

Review URL: https://codereview.chromium.org/1331553002

Cr-Commit-Position: refs/heads/master@{#30709}

Also clarify some comments.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1328193003

Cr-Commit-Position: refs/heads/master@{#30708}

These builtins present an optimization for the general addition case,
where one side is already known to be a string. Unfortunately this
optimization is wrong in the presence of @@toPrimitive (there are some
ideas how to implement a similar optimization using the prototype
backpointer mechanism that jkummerow@ introduced earlier). So this
also removes the broken %_IsStringWrapperSafeForDefaultValueOf, which is
the key part of the optimization mentioned above.

R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1336273002

Cr-Commit-Position: refs/heads/master@{#30707}

The String constructor was somewhat complex with a lot of micro
optimizations that are not relevant or even misguided. It would be
really hard to port that code to ES6, which requires String to be
subclassable. So as a first step we reduced the necessary complexity
to the bare minimum (also removing the last user of the fairly complex
MacroAssembler::LookupNumberStringCache method).

This also removes the counters for the String constructor, which
were not properly exposed anymore (and not kept in sync with inlined
versions of the String constructor anyway).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1335193002

Cr-Commit-Position: refs/heads/master@{#30706}

In certiain cases the ArgumentsIteratorSetter would trigger an invalid
state in the LookupIterator when being overridden. This is now solved
by bypassing the SetDataProperty and directly using
DefinePropertyOrElementIgnoringAttributes since we know exactly which
property we're going to install

LOG=N
BUG=chromium:521484

Review URL: https://codereview.chromium.org/1332873002

Cr-Commit-Position: refs/heads/master@{#30705}

R=machenbach@chromium.org
BUG=530941
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1340773002

Cr-Commit-Position: refs/heads/master@{#30704}

The GN default optimization flag is changing from being specific to the
debug/release status of the build to always being "default_optimization" so
it's easier to override without being conditional on the exact setup in
BUILDCONFIG.gn. See https://codereview.chromium.org/1324623005/

Since V8 is DEPS-ed in, it will need to support both modes to allow a landing.
This patch uses a temporary transitional flag I added to BUILDCONFIG to
indicate which variant should be used. After the patch is landed, we can remove
the new conditions and just remove default_optimization.

Review URL: https://codereview.chromium.org/1333963002

Cr-Commit-Position: refs/heads/master@{#30703}

BUG=None
LOG=N

Review URL: https://codereview.chromium.org/1332683002

Cr-Commit-Position: refs/heads/master@{#30702}

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1334273002

Cr-Commit-Position: refs/heads/master@{#30701}

Correctly save and restore FP registers in cctest/ConvertDToI to
avoid accidental register overwriting by the generated code.

Note: This failure is manifested only in R6 mode.

TEST=test/cctest/interpreter/test-interpreter
BUG=

Review URL: https://codereview.chromium.org/1337023002

Cr-Commit-Position: refs/heads/master@{#30700}

Port 622fa0ea

Original commit message:
Currently we do this dance between the CallConstructStub, the
CALL_* builtins and the %GetConstructorDelegate, %GetProxyTrap,
and %Apply runtime functions for every [[Construct]] operation on
non-function callables. This is complexity is unnecessary, and can
be simplified to work without any JS builtin. This will also make it
a lot easier to implement ES6 compliant [[Construct]] for proxies.

Also sanitize the invariant for CallConstructStub, which up until now
always restored the context itself, but that force us to always create
another copy of all arguments in case of proxies and other callables,
so we can relax that constraint by making the caller restore the context
(this only affects fullcodegen, since the optimizing compilers already
properly restore the context anyway).

BUG=

Review URL: https://codereview.chromium.org/1340553002

Cr-Commit-Position: refs/heads/master@{#30699}

Port 9fc4fc14

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1339673002

Cr-Commit-Position: refs/heads/master@{#30698}

Port 39604dda

Original commit message:
    Just use a %ThrowStackOverflow runtime function instead, which
    does the trick, especially since the Isolate already has a
    preallocated StackOverflow error for that.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1334303002

Cr-Commit-Position: refs/heads/master@{#30697}

Port 622fa0ea

Original commit message:
    Currently we do this dance between the CallConstructStub, the
    CALL_* builtins and the %GetConstructorDelegate, %GetProxyTrap,
    and %Apply runtime functions for every [[Construct]] operation on
    non-function callables. This is complexity is unnecessary, and can
    be simplified to work without any JS builtin. This will also make it
    a lot easier to implement ES6 compliant [[Construct]] for proxies.

    Also sanitize the invariant for CallConstructStub, which up until now
    always restored the context itself, but that force us to always create
    another copy of all arguments in case of proxies and other callables,
    so we can relax that constraint by making the caller restore the context
    (this only affects fullcodegen, since the optimizing compilers already
    properly restore the context anyway).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1338663003

Cr-Commit-Position: refs/heads/master@{#30696}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1332283002

Cr-Commit-Position: refs/heads/master@{#30695}

Cr-Commit-Position: refs/heads/master@{#30694}

Just use a %ThrowStackOverflow runtime function instead, which
does the trick, especially since the Isolate already has a
preallocated StackOverflow error for that.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1337883002

Cr-Commit-Position: refs/heads/master@{#30693}

This is so we can build with the flag on in the snapshot.
D8 then needs to be run with --vector-stores.

BUG=
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1339593002

Cr-Commit-Position: refs/heads/master@{#30692}

Currently we do this dance between the CallConstructStub, the
CALL_* builtins and the %GetConstructorDelegate, %GetProxyTrap,
and %Apply runtime functions for every [[Construct]] operation on
non-function callables. This is complexity is unnecessary, and can
be simplified to work without any JS builtin. This will also make it
a lot easier to implement ES6 compliant [[Construct]] for proxies.

Also sanitize the invariant for CallConstructStub, which up until now
always restored the context itself, but that force us to always create
another copy of all arguments in case of proxies and other callables,
so we can relax that constraint by making the caller restore the context
(this only affects fullcodegen, since the optimizing compilers already
properly restore the context anyway).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1335723002

Cr-Commit-Position: refs/heads/master@{#30691}