BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/972543003

Cr-Commit-Position: refs/heads/master@{#26944}

blink is incorrectly calling api functions without a context.  we need this to find those places

R=svenpanne@chromium.org

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/968943002

Cr-Commit-Position: refs/heads/master@{#26943}

- (x * (K << L)) & (-1 << L) => x * (K << L)
- ((K << L) * x) & (-1 << L) => x * (K << L)

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/972653002

Cr-Commit-Position: refs/heads/master@{#26942}

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/969733003

Cr-Commit-Position: refs/heads/master@{#26941}

BUG=v8:3929
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/971693002

Cr-Commit-Position: refs/heads/master@{#26940}

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/968773004

Cr-Commit-Position: refs/heads/master@{#26939}

Deferred replacement must also replace in the pending node vector.

BUG=chromium:463056
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/966423002

Cr-Commit-Position: refs/heads/master@{#26938}

BUG=v8:3929
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/958053003

Cr-Commit-Position: refs/heads/master@{#26937}

BUG=v8:3929
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/967243002

Cr-Commit-Position: refs/heads/master@{#26936}

On Intel targets, it is cheaper to load the context from the frame
instead of loading the context as a constant (which usually involves a
PropertyCell because the context is in new space when we compile the
function).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/970803002

Cr-Commit-Position: refs/heads/master@{#26935}

On 64-bit targets, we can skip the write barrier for Store nodes if the
input is ChangeInt32ToTagged, because the value being stored is
definitely represented as a smi then.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/968113002

Cr-Commit-Position: refs/heads/master@{#26934}

Revert of ES6: Make function name configurable (patchset #10 id:220001 of https://codereview.chromium.org/960343002/)

Reason for revert:
Breaks Chrome browser test that checks Object.name

[16509:16509:0228/030150:INFO:CONSOLE(43)] "Uncaught Error: Clobbered Object.name getter", source: http://www.chromium.org:33611/assertions.js (43)

http://build.chromium.org/p/client.v8/builders/Linux%20Tests%20%28dbg%29%281%29/builds/2328/steps/browser_tests/logs/stdio

Original issue's description:
> ES6: Make function name configurable
>
> This is partially based on r21609 but that CL was incomplete.
>
> Function name is still non writable so one has to use defineProperty
> to change the actual value.
>
> BUG=v8:3333
> LOG=N
> R=adamk, mstarzinger@chromium.org
>
> Committed: https://crrev.com/f7790f7670c8d859455a98fcb90ff1b66af1eca7
> Cr-Commit-Position: refs/heads/master@{#26924}

TBR=adamk@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3333

Review URL: https://codereview.chromium.org/969683002

Cr-Commit-Position: refs/heads/master@{#26933}

port 290ee378 (r26931).

original commit message:

UG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/963393002

Cr-Commit-Position: refs/heads/master@{#26932}

R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3930
LOG=Y

Committed: https://crrev.com/87f3e08e72510ee5544e82bb7ad39b2b5f001ad3
Cr-Commit-Position: refs/heads/master@{#26925}

Review URL: https://codereview.chromium.org/962263002

Cr-Commit-Position: refs/heads/master@{#26931}

Revert of Disallow subclassing Arrays. (patchset #3 id:40001 of https://codereview.chromium.org/962263002/)

Reason for revert:
Fails on nosnap build

Original issue's description:
> Disallow subclassing Arrays.
>
> R=rossberg@chromium.org,arv@chromium.org
> BUG=v8:3930
> LOG=Y
>
> Committed: https://crrev.com/87f3e08e72510ee5544e82bb7ad39b2b5f001ad3
> Cr-Commit-Position: refs/heads/master@{#26925}

TBR=arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3930

Review URL: https://codereview.chromium.org/965053002

Cr-Commit-Position: refs/heads/master@{#26930}

Revert of Regression test for v8:3930. (patchset #1 id:1 of https://codereview.chromium.org/961353002/)

Reason for revert:
Fails on nosnap builds

Original issue's description:
> Regression test for v8:3930.
>
> R=arv@chromium.org,rossberg@chromium.org
> BUG=v8:3930
> LOG=N
>
> Committed: https://crrev.com/48fb3e83c5882e9818bc1e0a035864b465602aca
> Cr-Commit-Position: refs/heads/master@{#26926}

TBR=arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3930

Review URL: https://codereview.chromium.org/965043002

Cr-Commit-Position: refs/heads/master@{#26929}

The auto-push script is only used in an automated fashion
on bots. It doesn't need to check for a clean git
environment as it has a special workdir checkout.

If the release creation fails for whatever reason (e.g.
a master restart happens in the middle), the workdir
checkout might be left dirty. Any new attempt of the auto
pusher then bails out.

After this change it will call the create_release script
in any case which tidies up the workspace on startup.

TBR=tandrii@chromium.org
NOTRY=true
TEST=./script_test.py

Review URL: https://codereview.chromium.org/960773007

Cr-Commit-Position: refs/heads/master@{#26928}

The test didn't call the test function.

BUG=v8:3932
LOG=N
TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/964993002

Cr-Commit-Position: refs/heads/master@{#26927}

R=arv@chromium.org,rossberg@chromium.org
BUG=v8:3930
LOG=N

Review URL: https://codereview.chromium.org/961353002

Cr-Commit-Position: refs/heads/master@{#26926}

R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3930
LOG=Y

Review URL: https://codereview.chromium.org/962263002

Cr-Commit-Position: refs/heads/master@{#26925}

This is partially based on r21609 but that CL was incomplete.

Function name is still non writable so one has to use defineProperty
to change the actual value.

BUG=v8:3333
LOG=N
R=adamk, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/960343002

Cr-Commit-Position: refs/heads/master@{#26924}

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/961263002

Cr-Commit-Position: refs/heads/master@{#26923}

BUG=v8:3754
LOG=N
R=dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/959313002

Cr-Commit-Position: refs/heads/master@{#26922}

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/958213006

Cr-Commit-Position: refs/heads/master@{#26921}

This required fixing the exports_ hash map to use the appropriate
comparison function instead of pointer comparison.

BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/960793003

Cr-Commit-Position: refs/heads/master@{#26920}

InstallBuiltinFunctionIds stood out when looking at code that grew
strangely when compiled with default optimizations.

This change from repeated code to a loop saves 6-7 KB of machine code.
I suspect it's faster but I also suspect it's fast enough either way so
that is not really a factor. Machine code reduction seen below.

Code formatted with git cl format.

clang x64:
Total change: -5985 bytes
-------------------------------------------
 +517 - Source: ?? - (gained 744, lost 227)
-------------------------------------------
  New symbols:
       +744: v8::internal::Genesis::InstallBuiltinFunctionIds()::builtins type=d, size=744 bytes
  Removed symbols:
         -4: .L.str98 type=r, size=4 bytes
... [stripped 30 similar lines]
        -19: .L.str100 type=r, size=19 bytes

----------------------------------------------------------------------------------------------
 -6502 - Source: /home/bratell/src/chromium/src/v8/src/bootstrapper.cc - (gained 0, lost 6502)
----------------------------------------------------------------------------------------------
  Removed symbols:
      -1135: v8::internal::ResolveBuiltinIdHolder(v8::internal::Handle<v8::internal::Context>, char const*) type=t, size=1135 bytes
  Shrunk symbols:
      -5367: v8::internal::Genesis::InstallBuiltinFunctionIds() type=t, (was 7105 bytes, now 1738 bytes)

BUG=

Review URL: https://codereview.chromium.org/918303005

Cr-Commit-Position: refs/heads/master@{#26919}

Rolling v8/buildtools to 93b3d0af1b30db55ee42bd2e983f7753153217db

Rolling v8/tools/clang to eb87c73202018d13f2f713e1304ab4edf9a6f49f

TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/962223002

Cr-Commit-Position: refs/heads/master@{#26918}

BUG=
TBR=svenpanne

Review URL: https://codereview.chromium.org/960903005

Cr-Commit-Position: refs/heads/master@{#26917}

Save Unknown position as zero in RelocInfo.
Remove copy constructor of SourcePosition because it is trivial.
Mechanical replace int raw_position with SourcePosition position.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/959203002

Cr-Commit-Position: refs/heads/master@{#26916}

BUG=

Committed: https://crrev.com/56039af476797accc238dcb24c7ab926899287a0
Cr-Commit-Position: refs/heads/master@{#26881}

Review URL: https://codereview.chromium.org/955393002

Cr-Commit-Position: refs/heads/master@{#26915}

BUG=v8:3929
LOG=Y

Review URL: https://codereview.chromium.org/959223002

Cr-Commit-Position: refs/heads/master@{#26914}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/967483003

Cr-Commit-Position: refs/heads/master@{#26913}

BUG=v8:3929
LOG=y

Review URL: https://codereview.chromium.org/962983002

Cr-Commit-Position: refs/heads/master@{#26912}

Without this shortcut we generate one BooleanNot per JSUnaryNot with
number input, which is quite common in asm.js. These dead nodes then
survive until the late control reducer runs, and may prevent
optimizations in the mean time.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/963713002

Cr-Commit-Position: refs/heads/master@{#26911}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/964843002

Cr-Commit-Position: refs/heads/master@{#26910}

MIPS: Skip the mapcheck on the global object since the global proxy and cell are already checked (or the global object map for contextual global loads).

Port 6af7ca6b

BUG=

Review URL: https://codereview.chromium.org/957393002

Cr-Commit-Position: refs/heads/master@{#26909}

port 6af7ca6b (r26886)

original commit message:

  Skip the mapcheck on the global object since the global proxy and cell are already
  checked (or the global object map for contextual global loads).

BUG=

Review URL: https://codereview.chromium.org/965693002

Cr-Commit-Position: refs/heads/master@{#26908}

Review URL: https://codereview.chromium.org/926553004

Cr-Commit-Position: refs/heads/master@{#26907}

 this is introduced by 88c4f52c (r26783)

BUG=

Review URL: https://codereview.chromium.org/958243004

Cr-Commit-Position: refs/heads/master@{#26906}

port e9cdcb71 (r26875)

original commit message:
  Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.
  Proxies up the chain are guaranteed to provide access if we had access to the receiver,
  since otherwise we wouldn't have been able to compile the stub in the first place.
  If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/964813002

Cr-Commit-Position: refs/heads/master@{#26905}