This unifies methods Deoptimizer::DoTranslateCommand, Deotpimizer::DoTranslateObject and the arguments object materializer.

To unify these, we have to separate reading of the input frame from writing to the output frame because the argument materializer does not write to output frames.

Instead, we now deoptimize in following stages:

1. Read out the input frame/registers, decode them using the translations from the deoptimizer and store them in the deoptimizer (Deoptimizer::translated_state_). This is done in TranslatedState::Init.

2. Write out into the output frame buffer all the values that do not require allocation. We also remember references to the values that require materialization. As before, this is done in Deoptimizer::DoCompute*Frame method, but instead calling to DoTranslateCommand, we use the translated frame to obtain the values and write them to the output frames.

3. The platform specific code then sets up the output frames and calls into the deoptimization notification. This has not been changed at all.

4. Once the stack is setup, we handlify all the references in the saved translated values (TranslatedState::Prepare).

5. Finally, we materialize all the values we remembered in step (1) and write them to their frames on the stack (using the TranslatedValue::GetValue method).

BUG=

Review URL: https://codereview.chromium.org/1136223004

Cr-Commit-Position: refs/heads/master@{#28826}

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1154303008

Cr-Commit-Position: refs/heads/master@{#28825}

BUG=

Review URL: https://codereview.chromium.org/1151883004

Cr-Commit-Position: refs/heads/master@{#28824}

This adds handling of JSLoadDynamicContext nodes to JSTypedLowering to
perform extension checks and an inline fast path. The fast path is a
context slot load targeting a specific context.

R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1155543003

Cr-Commit-Position: refs/heads/master@{#28823}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133153003

Cr-Commit-Position: refs/heads/master@{#28822}

BUG=chromium:430032
LOG=n

Review URL: https://codereview.chromium.org/1156183004

Cr-Commit-Position: refs/heads/master@{#28821}

Rolling v8/tools/clang to 1efaf64b8e648c8c6539245b10cbea6f3004eb61

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1168033003

Cr-Commit-Position: refs/heads/master@{#28820}

This reverts commit 75744da2.

revert reason:
              octane failures.

BUG=

Review URL: https://codereview.chromium.org/1160143008

Cr-Commit-Position: refs/heads/master@{#28819}

BUG=

Review URL: https://codereview.chromium.org/1149623010

Cr-Commit-Position: refs/heads/master@{#28818}

This in turn allows usage of AdvancedReducer::ReplaceWithValue which
has access to the underlying graph reducer.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1158723005

Cr-Commit-Position: refs/heads/master@{#28817}

BUG=chromium:471659, chromium:494158
LOG=N

Review URL: https://codereview.chromium.org/1151333005

Cr-Commit-Position: refs/heads/master@{#28816}

Currently does super.prop (load) and super.method() (call). Like full
codegen it uses runtime calls to load the property value.

BUG=v8:3330
LOG=N
R=mstarzinger@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1149133005

Cr-Commit-Position: refs/heads/master@{#28815}

We should not skip holes for these 2 functions.

BUG=v8:3895
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1165003005

Cr-Commit-Position: refs/heads/master@{#28814}

This in turn allows usage of AdvancedReducer::ReplaceWithValue which
has access to the underlying graph reducer. It will allow us to deal
with exception continuations correctly.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1158273011

Cr-Commit-Position: refs/heads/master@{#28813}

Only optimized for TF

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1146963002

Cr-Commit-Position: refs/heads/master@{#28812}

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1160253010

Cr-Commit-Position: refs/heads/master@{#28811}

This allows any AdvancedReducer to remove exception projections from
graphs. This is the common case when JS-operators are being replaced
with pure values. The old NodeProperties::ReplaceWithValue is being
deprecated in favor of AdvancedReducer::ReplaceWithValue.

R=titzer@chromium.org
TEST=unittests/AdvancedReducerTest

Review URL: https://codereview.chromium.org/1168693002

Cr-Commit-Position: refs/heads/master@{#28810}

BUG=chromium:496013
LOG=N

Review URL: https://codereview.chromium.org/1163203002

Cr-Commit-Position: refs/heads/master@{#28809}

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1163523008

Cr-Commit-Position: refs/heads/master@{#28808}

Rolling v8/third_party/icu to 9939a5d5314b6d59d5fb070902d73304c2482f88

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1168573003

Cr-Commit-Position: refs/heads/master@{#28807}

We used to only store the uses_super_property in the preparse data
logger. Let the logger use NeedsHomeObject instead.

BUG=v8:3768
LOG=N
R=wingo, adamk

Review URL: https://codereview.chromium.org/1164073003

Cr-Commit-Position: refs/heads/master@{#28806}

Also stages ES6 @@isConcatSpreadable support.

BUG=v8:3578
LOG=y

Review URL: https://codereview.chromium.org/1148983006

Cr-Commit-Position: refs/heads/master@{#28805}

Blink's DOM bindings are not yet ready.

BUG=493137, 239915
LOG=N
R=rossberg, adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1153263004

Cr-Commit-Position: refs/heads/master@{#28804}

This patch re-commits a previous commit after fixing a test to not
run into another known bug.
This reverts commit b104a67e.

This patch implements the last two methods on TypedArrays. These
were previously committed and led to a test failure.

BUG=v8:3578
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1159663004

Cr-Commit-Position: refs/heads/master@{#28803}

Before this we had 3 super related lexical bindings that got injected
into method bodies: .home_object, .this_function,  and new.target.
With this change we get rid of the .home_object one in favor of using
.this_function[home_object_symbol] which allows some simplifications
throughout the code base.

BUG=v8:3768
LOG=N
R=adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1154103005

Cr-Commit-Position: refs/heads/master@{#28802}

Embed constant pools within their corresponding Code
objects.

This removes support for out-of-line constant pools in favor
of the new approach -- the main advantage being that it
eliminates the need to allocate and manage separate constant
pool array objects.

Currently supported on PPC and ARM.  Enabled by default on
PPC only.

This yields a 6% improvment in Octane on PPC64.

R=bmeurer@chromium.org, rmcilroy@chromium.org, michael_dawson@ca.ibm.com
BUG=chromium:478811
LOG=Y

Review URL: https://codereview.chromium.org/1162993006

Cr-Commit-Position: refs/heads/master@{#28801}

Review URL: https://codereview.chromium.org/1152993005

Cr-Commit-Position: refs/heads/master@{#28800}

Rolling v8/tools/clang to b7e158c9336030c1527dfbce92656a2d7b8cfb60

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1150313007

Cr-Commit-Position: refs/heads/master@{#28799}

BUG=

Review URL: https://codereview.chromium.org/1167613004

Cr-Commit-Position: refs/heads/master@{#28798}

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1153373003

Cr-Commit-Position: refs/heads/master@{#28797}

This is behind the flag "--harmony-atomics", and it only works on
SharedArrayBuffers. This implementation only includes the runtime functions.
The TurboFan implementation will be next.

The draft spec for Atomics can be found here:
https://docs.google.com/document/d/1NDGA_gZJ7M7w1Bh8S0AoDyEqwDdRh4uSoTPSNn77PFk

BUG=
LOG=n

Review URL: https://codereview.chromium.org/1162503002

Cr-Commit-Position: refs/heads/master@{#28796}

Port 4b8051a0

Original commit message:
This splits the SuperReference AST node into SuperPropertyReference and
SuperCallReference. The super call reference node consists of three
unresolved vars to this, new.target and this_function. These gets
declared when the right function is entered and if it is in use. The
variables gets assigned in FullCodeGenerator::Generate.

This is a revert of the revert 88b1c917

BUG=v8:3768
LOG=N

Review URL: https://codereview.chromium.org/1160973008

Cr-Commit-Position: refs/heads/master@{#28795}

Port e4782a9b

Original commit message:
Previously the %_DateField intrinsic would also check the object and
throw an exception if you happen to pass something that is not a valid
JSDate, which (a) violates our policy for instrinsics and (b) is hard to
optimize in TurboFan (even Crankshaft has a hard time, but there we will
never inline the relevant builtins, so it doesn't show up). The throwing
part is now a separate intrinsics %_ThrowIfNotADate that throws an
exception in full codegen and deoptimizes in Crankshaft, which means the
code for the current use cases is roughly the same (modulo some register
renamings/gap moves).

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1170463002

Cr-Commit-Position: refs/heads/master@{#28794}

This will significantly simplify the serialization code, as well
as speeding it up (by triggering only a single allocation instead of O(size)
allocations).

BUG=chromium:478263
LOG=y

Review URL: https://codereview.chromium.org/1157843006

Cr-Commit-Position: refs/heads/master@{#28793}

Review URL: https://codereview.chromium.org/1159553011

Cr-Commit-Position: refs/heads/master@{#28792}

Port 4b8051a0

Original commit message:
This splits the SuperReference AST node into SuperPropertyReference and
SuperCallReference. The super call reference node consists of three
unresolved vars to this, new.target and this_function. These gets
declared when the right function is entered and if it is in use. The
variables gets assigned in FullCodeGenerator::Generate.

This is a revert of the revert 88b1c917

R=arv@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1146403010

Cr-Commit-Position: refs/heads/master@{#28791}

BUG=chromium:493284
LOG=N

Review URL: https://codereview.chromium.org/1147343004

Cr-Commit-Position: refs/heads/master@{#28790}

BUG=v8:4131
LOG=n

Review URL: https://codereview.chromium.org/1155493007

Cr-Commit-Position: refs/heads/master@{#28789}

This fixes a corner-case where arrow functions that require a context
allocate none, because there are no additional slots allocated. Note
that this didn't happen with true function scopes because they always
had at least the receiver slot.

The outcome was a context chain that no longer was in sync with the
scope chain, hence context slot loads were bogus. This is observable
using the DYNAMIC_LOCAL optimization in all compilers.

R=rossberg@chromium.org,wingo@igalia.com
TEST=mjsunit/harmony/regress/regress-4160
BUG=v8:4160
LOG=N

Review URL: https://codereview.chromium.org/1146063006

Cr-Commit-Position: refs/heads/master@{#28788}

The IC for modulus is usually way faster than converting the inputs to
numbers and doing a Float64Mod on them.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1170433002

Cr-Commit-Position: refs/heads/master@{#28787}