Port b6419fa2

Original commit message:
    Now implemented as a builtin that delegates to the InstanceOfStub. That
    stub was parameterized to fallback to either Runtime_InstanceOf or to
    Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
    Once the feature stabilizes and the flag is no longer needed, we can get
    rid of this parameterization again.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1827583002

Cr-Commit-Position: refs/heads/master@{#35025}

BUG=v8:4280,v8:4747
LOG=N

Review URL: https://codereview.chromium.org/1825103002

Cr-Commit-Position: refs/heads/master@{#35024}

The bytecode handler for ForInDone can just do a word comparison on
index and cache length instead of calling out to %ForInDone.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1825513003

Cr-Commit-Position: refs/heads/master@{#35023}

We use the pattern "B23" to refer to RPO numbers and "id:42" when
referring to unordered block ids. This unifies printing functions to
follow that pattern throughout the system.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1824313002

Cr-Commit-Position: refs/heads/master@{#35022}

Revert of [CQ] Reduce code-coverage experiment factor. (patchset #1 id:1 of https://codereview.chromium.org/1822703002/ )

Reason for revert:
More bots added.

Original issue's description:
> [CQ] Reduce code-coverage experiment factor.
>
> BUG=chromium:568949
> LOG=n
> TBR=kjellander@chromium.org, tandrii@chromium.org
> NOTRY=true
> NOPRESUBMIT=true
>
> Committed: https://crrev.com/76f677fc6d0b147603ddda2d5809086b0d36d900
> Cr-Commit-Position: refs/heads/master@{#34946}

TBR=kjellander@chromium.org,tandrii@chromium.org
BUG=chromium:568949
LOG=n
NOPRESUBMIT=true
NOTRY=true

Review URL: https://codereview.chromium.org/1816283004

Cr-Commit-Position: refs/heads/master@{#35021}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1823973002

Cr-Commit-Position: refs/heads/master@{#35020}

  port 66e22b79 (r34979)

  original commit message:
  ... because Debugger could still require them to inspect optimized frames.

BUG=

Review URL: https://codereview.chromium.org/1826673003

Cr-Commit-Position: refs/heads/master@{#35019}

  port 1da4b88e (r34978)

  original commit message:
  The idiv instruction has 2 registers as output. This needs to be
  modeled so that the move optimizer won't incorrectly elide away
  moves.

BUG=

Review URL: https://codereview.chromium.org/1823403002

Cr-Commit-Position: refs/heads/master@{#35018}

With the recent spec change removing the [[Enumerate]] internal method, we now
have to walk the complete prototype chain. This implies that we call the
[[GetPrototypeOf]] trap on proxies.

As a secondary change we now trigger the [[GetOwnProperty]] trap for the for-in
filter step to see whether the properties are still enumerable. Before we did this
in the key-accumulation phase. This way we slightly reduce the number of traps
invoked. Whilst this is not ideal, it comes closer to the Spec's example
implementation.

BUG=v8:1543, v8:4768
LOG=n

Review URL: https://codereview.chromium.org/1748923003

Cr-Commit-Position: refs/heads/master@{#35017}

We establish spilling blocks for ranges spilling only in deferred blocks
really late - just before optimization. This means frame elision logic
should happen after all dust has settled - even after optimization, since
we may lose spills after that (this is not currently leveraged).

Also enabled the elision algo for all functions, but forcing the first frame
to construct a frame for non-code stub cases.  This is preparing for a
subsequent change where we guide frame construction/destruction
solely based on the info produced by the register allocation pipeline.

BUG=

Review URL: https://codereview.chromium.org/1810333003

Cr-Commit-Position: refs/heads/master@{#35016}

Validate that the transition from deferred to hot happens through a
deferred block with one successor. This is needed for frame elision: if
we need to deconstruct the frame on the deferred path, this extra block
offers that location.

A precondition for this validation is that the sequence is in split edge
form.

BUG=

Review URL: https://codereview.chromium.org/1811213003

Cr-Commit-Position: refs/heads/master@{#35015}

This CL adds an extra pass before calculating the special RPO
order in the custom RawMachineAssembler pipeline that
walks through the schedule and inserts extra blocks to
guarantee that the control flow graph is in split edge form. It
also propagates deferred block marks forward to these new
blocks if appropriate.

Review URL: https://codereview.chromium.org/1811333002

Cr-Commit-Position: refs/heads/master@{#35014}

In the frame elider, we were propagating marks if both up and down
propagations were causing a change. We should do it until neither
changes.

BUG=

Review URL: https://codereview.chromium.org/1818503002

Cr-Commit-Position: refs/heads/master@{#35013}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1827523005

Cr-Commit-Position: refs/heads/master@{#35012}

The value projection of the Add/SubWithOverflow must be scheduled after
the Branch that dispatches based on overflow in order for the
instruction selector to be able to combine the addition/subtraction with
the branching.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1827463003

Cr-Commit-Position: refs/heads/master@{#35011}

Port 7ec8ecce

LOG=N
R=bbudge@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4124

Review URL: https://codereview.chromium.org/1825643002

Cr-Commit-Position: refs/heads/master@{#35010}

Rolling v8/tools/clang to f5219dd53ee7a87a07085ce03083456231ba0c27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1825283005

Cr-Commit-Position: refs/heads/master@{#35009}

The warning notes that we'd want a 'w' register here because the size of
the operand is 32-bit, however, the instruction only takes an 'x'
register and so force that using the 'x' modifier on the instruction.

BUG=

Review URL: https://codereview.chromium.org/1817963003

Cr-Commit-Position: refs/heads/master@{#35008}

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1820293002

Cr-Commit-Position: refs/heads/master@{#35007}

Port 9536c388

R=verwaest@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1824133002

Cr-Commit-Position: refs/heads/master@{#35006}

Port 75ed4a60
R=verwaest@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1825623002

Cr-Commit-Position: refs/heads/master@{#35005}

Port b7aa4c3a

Original commit message:
    Split ToNumberStub into the entry ToNumberStub, and two new stubs,
    StringToNumberStub and NonNumberToNumberStub, which can be used when we
    already know something about the input (i.e. in various branches of the
    code stubs, or in TurboFan graphs).

    Also introduce an appropriate StringToNumber simplified operator for
    TurboFan, that is pure and is lowered to an invocation of the newly
    added StringToNumberStub.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1825593003

Cr-Commit-Position: refs/heads/master@{#35004}

Port acbb968d
Port 66e22b79

Original commit messages:
    In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
    Otherwise we will see G in a stack trace inside H.

    This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

    Always generate lazy bailout points for tail calls because Debugger could still require them to inspect optimized frames.

R=ishell@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1820373002

Cr-Commit-Position: refs/heads/master@{#35003}

Now that ES2015 const has shipped, in Chrome 49, legacy const declarations
are no more. This lets us remove a bunch of code from many parts of the
codebase.

In this patch, I remove parser support for generating legacy const variables
from const declarations. This also removes the special "illegal declaration"
bit from Scope, which has ripples into all compiler backends.

Also gone are any tests which relied on legacy const declarations.

Note that we do still generate a Variable in mode CONST_LEGACY in one case:
function name bindings in sloppy mode. The likely fix there is to add a new
Variable::Kind for this case and handle it appropriately for stores in each
backend, but I leave that for a later patch to make this one completely
subtractive.

Review URL: https://codereview.chromium.org/1819123002

Cr-Commit-Position: refs/heads/master@{#35002}

String.prototype.match is specified to call out to the current
value of RegExp.prototype[Symbol.match] when passed a string argument,
rather than the original value. This patch updates the RegExp code
to do that.

R=yangguo@chromium.org
BUG=v8:4602
LOG=Y

Review URL: https://codereview.chromium.org/1821773003

Cr-Commit-Position: refs/heads/master@{#35001}

The 'key' value being passed into an array access should
be sign-extended on 64-bit platforms before being used to
index into memory.  Otherwise, garbage in the upper 32-bits
may result in a segmentation fault.

Minor fix to DoFlooringDivI to enforce 32-bit operations for calculation.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1822103002

Cr-Commit-Position: refs/heads/master@{#35000}

Port 1134688c

Original commit message:
    This roughly doubles performance for generic Array.prototype.push.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1823103002

Cr-Commit-Position: refs/heads/master@{#34999}

Port b7aa4c3a

Original commit message:
    Split ToNumberStub into the entry ToNumberStub, and two new stubs,
    StringToNumberStub and NonNumberToNumberStub, which can be used when we
    already know something about the input (i.e. in various branches of the
    code stubs, or in TurboFan graphs).

    Also introduce an appropriate StringToNumber simplified operator for
    TurboFan, that is pure and is lowered to an invocation of the newly
    added StringToNumberStub.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1826483002

Cr-Commit-Position: refs/heads/master@{#34998}

Port b6419fa2

Original commit message:
    Now implemented as a builtin that delegates to the InstanceOfStub. That
    stub was parameterized to fallback to either Runtime_InstanceOf or to
    Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
    Once the feature stabilizes and the flag is no longer needed, we can get
    rid of this parameterization again.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1825083002

Cr-Commit-Position: refs/heads/master@{#34997}

Port acbb968d
Port 66e22b79

Original commit messages:
    In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
    Otherwise we will see G in a stack trace inside H.

    This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

    Always generate lazy bailout points for tail calls because Debugger could still require them to inspect optimized frames.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1825513002

Cr-Commit-Position: refs/heads/master@{#34996}

Revert of [es6] Ship new ES6 instanceof operator semantics. (patchset #1 id:1 of https://codereview.chromium.org/1820903002/ )

Reason for revert:
Breaks two layout tests when rolling into Chromium. Tests needs investigation and most likely a rebaseline. The following are the tests that fail:

- imported/web-platform-tests/html/semantics/text-level-semantics/the-time-element/001.html
- fast/dom/Window/window-postmessage-clone-deep-array.html

https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64/5594/layout-test-results/results.html

Original issue's description:
> [es6] Ship new ES6 instanceof operator semantics.
>
> R=hablich@chromium.org
> BUG=v8:4447
> LOG=n
>
> Committed: https://crrev.com/5836807ea89b96ecfb4bbd8febf0d67bb8dae9ed
> Cr-Commit-Position: refs/heads/master@{#34984}

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4447

Review URL: https://codereview.chromium.org/1823813003

Cr-Commit-Position: refs/heads/master@{#34995}

This adds two new stubs, AddStub and SubtractStub, for the plus and the
minus operators, and hooks them up with TurboFan and Ignition.
Especially the addition case is very heavy and we might want to look
into splitting that up further into specialized stubs (similar to what
we did with ToNumberStub recently).

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1823083002

Cr-Commit-Position: refs/heads/master@{#34994}

Cleanup, and matches Chromium's build.

Review URL: https://codereview.chromium.org/1820583002

Cr-Commit-Position: refs/heads/master@{#34993}

BUG=v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1782743003

Cr-Commit-Position: refs/heads/master@{#34992}

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1821183002

Cr-Commit-Position: refs/heads/master@{#34991}

Otherwise, no handler would be dumped when using a snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1821663002

Cr-Commit-Position: refs/heads/master@{#34990}

This CL adds support for builtins with JavaScript linkage written using
the TurboFan CodeStubAssembler, but with a JSCall descriptor (which was
already supported thanks to a previous patch by Ben Smith). As a first
example, we convert the Math.sqrt builtin and thereby get rid of the
%_MathSqrt intrinsic, which causes trouble for the representation
selection pass in the JavaScript pipeline.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1824993002

Cr-Commit-Position: refs/heads/master@{#34989}

* Not jump around all memory to gather whether we need to profile
* Cache this information and dispatch to a templatized function

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1820263002

Cr-Commit-Position: refs/heads/master@{#34988}

This roughly doubles performance for generic Array.prototype.push.

BUG=

Review URL: https://codereview.chromium.org/1816553002

Cr-Commit-Position: refs/heads/master@{#34987}

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1819073003

Cr-Commit-Position: refs/heads/master@{#34986}