Adds support to collect allocation site feedback for Array function calls
to the call bytecode handler.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2307903002
Cr-Commit-Position: refs/heads/master@{#39283}

I could not reproduce the bug in either a unittest nor a cctest. That's
why I created an mjsunit test now.

BUG=chromium:644682
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2319213003
Cr-Commit-Position: refs/heads/master@{#39282}

BUG=chromium:644643
NOTRY=true

Review-Url: https://codereview.chromium.org/2319583002
Cr-Commit-Position: refs/heads/master@{#39281}

Review-Url: https://codereview.chromium.org/2321543003
Cr-Commit-Position: refs/heads/master@{#39280}

The existing PropertyQueryCallback intercepts getOwnPropertyDescriptor, but
it returns only value and attributes, not the accessors. This
PropertyDescriptorCallback returns a descriptor similar to Ecma-262 6.2.4.

You can either set a PropertyQueryCallback or a PropertyDescriptorCallback,
but not both. When you set a callback for DefineProperty(), you can set a
PropertyDescriptorCallback but not a PropertyQueryCallback.

BUG=v8:5359

Review-Url: https://codereview.chromium.org/2311873002
Cr-Commit-Position: refs/heads/master@{#39279}

BUG=

Review-Url: https://codereview.chromium.org/2324623004
Cr-Commit-Position: refs/heads/master@{#39278}

This fixes the materialization of JSFunction objects to not rely on a
context being available. The context has been cleared because it might
be de-materiallized itself.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/escape-analysis-materialize
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2320983002
Cr-Commit-Position: refs/heads/master@{#39277}

Review-Url: https://codereview.chromium.org/2319243002
Cr-Commit-Position: refs/heads/master@{#39276}

The test was using some callee saved registers but tests don't save those.

BUG=v8:5354

Review-Url: https://codereview.chromium.org/2322923002
Cr-Commit-Position: refs/heads/master@{#39275}

This fixes the materialization of JSArray objects to not rely on a
context being available. The context has been cleared because it might
be de-materiallized itself.

R=bmeurer@chromium.org
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2323713002
Cr-Commit-Position: refs/heads/master@{#39274}

BUG=chromium:636331
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2319683002
Cr-Commit-Position: refs/heads/master@{#39273}

This patch moves the following parsing methods to ParserBase:

- ParseScopedStatement
- ParseVariableStatement
- ParseDebuggerStatement
- ParseV8Intrinsic

It also cleans up the implementation-specific use counter mechanism.

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2318263002
Cr-Commit-Position: refs/heads/master@{#39272}

Review-Url: https://codereview.chromium.org/2319173002
Cr-Commit-Position: refs/heads/master@{#39271}

This adds support to the deoptimizer to materialize ContextExtension
objects that have been de-materialized by escape analysis. This is
follow-up to the inline allocation of such objects during the create
lowering phase (i.e. JSCreateWithContext and JSCreateCatchContext).

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-644245
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2317353003
Cr-Commit-Position: refs/heads/master@{#39270}

Also roll build and android_tools, which contains a bump of
the ndk to r12b.

BUG=chromium:629806

Review-Url: https://codereview.chromium.org/2320843003
Cr-Commit-Position: refs/heads/master@{#39269}

Delete unused CSA::AllocateUninitializedFixedArray() which also does not
respect ParameterMode concept.

Review-Url: https://codereview.chromium.org/2321643002
Cr-Commit-Position: refs/heads/master@{#39268}

This clears the context register by setting it to Smi(0) before calling
the Runtime::kNotifyDeoptimized helper. The deoptimizer must be able to
materialize all heap objects without any context available. The context
itself might be dematerialized.

With this change we make sure that invariant is maintained even without
escape analysis kicking in. We also satisfy the check that the context
register is either Smi(0) or a valid context. It might have been the
special {arguments_marker} in this particular case.

R=bmeurer@chromium.org
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2320673002
Cr-Commit-Position: refs/heads/master@{#39267}

When lowering Array.prototype.push/.pop to the fast inlined version, we
first need to ensure that all prototypes (including the Object.prototype)
are stable.

R=mvstanton@chromium.org
BUG=chromium:644689

Review-Url: https://codereview.chromium.org/2319533005
Cr-Commit-Position: refs/heads/master@{#39266}

BUG=

Review-Url: https://codereview.chromium.org/2304133002
Cr-Commit-Position: refs/heads/master@{#39265}

Reason for revert:
Breaks g++ build.

Original issue's description:
> [turbofan] ARM: Implement vswp and use in gap resolver
>
> Use vswp to switch double-precision registers in the gap resolver, with fall
> back temp register-based code if NEON is not available.
>
> BUG=
>
> Committed: https://crrev.com/2837c2e65a2ee5b9fc610f30ce1215f52323ecbd
> Cr-Commit-Position: refs/heads/master@{#39209}

BUG=

Review-Url: https://codereview.chromium.org/2314043002
Cr-Commit-Position: refs/heads/master@{#39264}

BUG=

Review-Url: https://codereview.chromium.org/2292973002
Cr-Commit-Position: refs/heads/master@{#39263}

The optimization is not correct for unsigned output types, and we the
overall complexity seems too high. We need to find a better way to
take into account the input/output type restrictions.

Also added a regression test for the unsigned output bug.

BUG=v8:5267,v8:5270,v8:5357
TBR=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2320013002
Cr-Commit-Position: refs/heads/master@{#39262}

The trouble here is that the type of the induction variable might be
a bit ahead of the increment (JSAdd) operation's type. When we update
the type of the increment, we might only update the induction variable
type while the JSAdd type might be stale. If the induction variable typing
needs to fall back to normal phi typing (e.g., when the increment is not
an integer anymore), it might use the stale type.

To get around this, we fake monotonicity if we fallback to normal phi
typing. Another option would be to force re-typing of the increment
operation, but that seems to be harder to maintain.

BUG=chromium:644633

Review-Url: https://codereview.chromium.org/2320803002
Cr-Commit-Position: refs/heads/master@{#39261}

This patch fixes a bunch of out-of-date TODOs, un-skips some tests
and refers to appropriate bug numbers and current specification
status where appropriate.

R=adamk

Review-Url: https://codereview.chromium.org/2319203002
Cr-Commit-Position: refs/heads/master@{#39260}

BUG=

Review-Url: https://codereview.chromium.org/2315413002
Cr-Commit-Position: refs/heads/master@{#39259}

Move it to HARMONY_STAGED bucket

Spec discussion:  https://github.com/tc39/ecma402/issues/30
It's in stage 4 and Firefox has already implemented it.

BUG=v8:5244
TEST=intl/date-format/date-format-to-parts.js
TEST=test262/intl402/DateTimeFormat/prototype/formatToParts/*

Review-Url: https://codereview.chromium.org/2317783003
Cr-Commit-Position: refs/heads/master@{#39258}

While fixing the bug, removed code duplication from super load/store
runtime calls, and inlined calls of Object::ReadAbsentProperty (left
over from strong mode).

BUG=v8:5335

Review-Url: https://codereview.chromium.org/2311413002
Cr-Commit-Position: refs/heads/master@{#39257}

This adds support for dematerialized context values as part of an
interpreted frame (similar to an FCG frame). Both frame translations
should be kept in sync as much as possible.

R=rmcilroy@chromium.org
BUG=chromium:644728

Review-Url: https://codereview.chromium.org/2313343002
Cr-Commit-Position: refs/heads/master@{#39256}

Chromium doesn't support lsan with mac's current toolchain.

BUG=chromium:644643
NOTRY=true

Review-Url: https://codereview.chromium.org/2322493002
Cr-Commit-Position: refs/heads/master@{#39255}

This yields a ~5% serialization time improvement on typical JSON-esque data.
The approach taken matches json-stringifier fairly closely.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2311063004
Cr-Commit-Position: refs/heads/master@{#39254}

Testcase regress/regress-353551 fails with stack overflow error on
ppc64, increasing stack-size to 1100 resolves the issue, but will
cause other platforms to fail similar to
https://codereview.chromium.org/2072533002.
For now, disabling the testcase on ppc64.

R=machenbach@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2314343002
Cr-Commit-Position: refs/heads/master@{#39253}

On PPC the testcase CodeSerializerLargeCodeObject fails as
the object gets allocated in the code_space section of
the heap. This is because the code_space gets expanded
successfully to 1 page size (4MB on PPC) and can accommodate
the object (size=3784608 bytes). Increasing size of the compiled
source to (5096192 bytes) so that code_space is not expanded and
the space is allocated in the Large Object space of the heap.
Testcase was added as part of https://codereview.chromium.org/2226233002

R=mstarzinger@chromium.org, bmeurer@chromium.org

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2314843003
Cr-Commit-Position: refs/heads/master@{#39252}

This patch moves the following parsing methods to ParserBase:

- ParseBlock

R=adamk@chromium.org, marja@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2312263002
Cr-Commit-Position: refs/heads/master@{#39251}

BUG=chromium:644713
LOG=NO

Review-Url: https://codereview.chromium.org/2322453002
Cr-Commit-Position: refs/heads/master@{#39250}

Move StringToNumber builtin implementation to helper function in
CodeStubAssembler.

BUG=

Review-Url: https://codereview.chromium.org/2293943002
Cr-Commit-Position: refs/heads/master@{#39249}

This is analogous to the variable liveness analysis we do in the AstGraphBuilder, but on the bytecode registers.

BUG=

Review-Url: https://codereview.chromium.org/2307863002
Cr-Commit-Position: refs/heads/master@{#39248}

Review-Url: https://codereview.chromium.org/2319563002
Cr-Commit-Position: refs/heads/master@{#39247}

We were previously incorrectly changing:
  sub r0, 0, r1
  cmp r2, r0
  b.cond <addr>
to:
  cmn r2, r1
  b.cond <addr>

for all conditions. This is incorrect for conditions involving the C (carry)
and V (overflow) flags, and in particular in the case where r1 = INT_MIN.
The optimization is still safe to perform for Equal and NotEqual since they
do not depend on the C and V flags.

BUG=

Review-Url: https://codereview.chromium.org/2318043002
Cr-Commit-Position: refs/heads/master@{#39246}

Remove dynamic libraries that are automatically included.

BUG=chromium:644643
NOTRY=true

Review-Url: https://codereview.chromium.org/2219423002
Cr-Commit-Position: refs/heads/master@{#39245}

This implements the CompilationInfo::context explicitly instead of
delegating to the underlying ParseInfo. This is in preparation for
ParseInfo not having to store the context at all soon.

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2316083002
Cr-Commit-Position: refs/heads/master@{#39244}