port 7c347c54 (r27511)

original commit message:

    A bug allows JSObject literals with elements to have the elements in the
    boilerplate modified.

BUG=

Review URL: https://codereview.chromium.org/1057883004

Cr-Commit-Position: refs/heads/master@{#27595}

Port b134ae74

Original commit message:
BUG=v8:3539
LOG=N

R=verwaest@chromium.org, mbrandy@us.ibm.com

Review URL: https://codereview.chromium.org/1052973003

Cr-Commit-Position: refs/heads/master@{#27594}

Remove unused macro-asm instruction and associated address patching.

On mips64, remove unused JumpLabelToJumpRegister(). On mips, rename
it appropriately (it's still used there for JR->J optimizations).

BUG=

Review URL: https://codereview.chromium.org/1059433003

Cr-Commit-Position: refs/heads/master@{#27593}

As with TF fix 94506cc3, correctly support absurdly large stack
adjustments.

TEST=mozilla/js/tests/js1_5/Regress/regress-396684.js
BUG=

Review URL: https://codereview.chromium.org/1057763002

Cr-Commit-Position: refs/heads/master@{#27592}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1057843002

Cr-Commit-Position: refs/heads/master@{#27591}

BUG=chromium:98597
LOG=N

Review URL: https://codereview.chromium.org/1052943003

Cr-Commit-Position: refs/heads/master@{#27590}

Revert of make ToLocalCheck crash in release mode (patchset #1 id:1 of https://codereview.chromium.org/1043363005/)

Reason for revert:
breaks some devtools things

Original issue's description:
> make ToLocalCheck crash in release mode
>
> R=svenpanne@chromium.org
> BUG=
>
> Committed: https://crrev.com/ce7cc5119c1e031bf1eb8476fbf5e55bef738f94
> Cr-Commit-Position: refs/heads/master@{#27585}

TBR=svenpanne@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1057873003

Cr-Commit-Position: refs/heads/master@{#27589}

This keeps the length of the context chain tracked by the environment
in sync even for local control flow commands. It removes the need to
guess the correct chain length at Environment::Merge points.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1045703003

Cr-Commit-Position: refs/heads/master@{#27588}

BUG=v8:3539
LOG=N

Review URL: https://codereview.chromium.org/1038043002

Cr-Commit-Position: refs/heads/master@{#27587}

BUG=chromium:472513
LOG=Y

Review URL: https://codereview.chromium.org/1058793002

Cr-Commit-Position: refs/heads/master@{#27586}

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1043363005

Cr-Commit-Position: refs/heads/master@{#27585}

R=machenbach@chromium.org
BUG=chromium:408675
LOG=N

Review URL: https://codereview.chromium.org/1051653003

Cr-Commit-Position: refs/heads/master@{#27584}

The original code will not update the IC info if one of parameter is SMI. It Can not handle Number + Smi.

BUG=

Review URL: https://codereview.chromium.org/1056663005

Cr-Commit-Position: refs/heads/master@{#27583}

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1053583005

Cr-Commit-Position: refs/heads/master@{#27582}

BUG=v8:3539
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1029093002

Cr-Commit-Position: refs/heads/master@{#27581}

BUG=v8:3996
LOG=y
R=dslomov@chromium.org,kbr@chromium.org,hpayer@chromium.org

Review URL: https://codereview.chromium.org/1041403003

Cr-Commit-Position: refs/heads/master@{#27580}

BUG=none
R=danno@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/960903003

Cr-Commit-Position: refs/heads/master@{#27579}

Currently, this doesn't really help to generate better code,
nevertheless this is the right thing to do. When our type system(s)
are fixed, this should avoid falling back to floating point operations
in various cases.

Review URL: https://codereview.chromium.org/1057813002

Cr-Commit-Position: refs/heads/master@{#27578}

  language/asi/S7.9_A5.7_T1

http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3024/steps/Test262-es6/logs/S7.9_A5.7_T1

This looks suspicious. Maybe the monkeyYaml is the reason for this?

BUG=None
TBR=adamk

Review URL: https://codereview.chromium.org/1052083002

Cr-Commit-Position: refs/heads/master@{#27577}

BUG=None
LOG=N
R=adamk, rossberg

Review URL: https://codereview.chromium.org/1052013002

Cr-Commit-Position: refs/heads/master@{#27576}

BUG=

Review URL: https://codereview.chromium.org/1052653003

Cr-Commit-Position: refs/heads/master@{#27575}

Could not encode the large slot number in opcode MiscField.

TEST=mozilla/js/tests/js1_5/Regress/regress-396684.js
BUG=

Review URL: https://codereview.chromium.org/1043393002

Cr-Commit-Position: refs/heads/master@{#27574}

R=vogelheim@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1049383004

Cr-Commit-Position: refs/heads/master@{#27573}

The /NativeError/ functions should have Error as their [[Prototype]].

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-properties-of-the-nativeerror-constructors

BUG=v8:3998
LOG=N
R=adamk, dslomov@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1049323003

Cr-Commit-Position: refs/heads/master@{#27572}

R=mstarzinger@chromium.org
BUG=v8:3976
BUG=472504
LOG=y

Review URL: https://codereview.chromium.org/1051833002

Cr-Commit-Position: refs/heads/master@{#27571}

As long as we still have to process global handles, the impact is not
yet worthwhile

BUG=v8:3862
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1050443002

Cr-Commit-Position: refs/heads/master@{#27570}

In ES6 Object.getOwnPropertyDescriptor should call ToObject, which
means that primitive values will return descriptors from the wrapper.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/998163004

Cr-Commit-Position: refs/heads/master@{#27569}

Revert of Remove promotion backup case and report OOM instead. (patchset #2 id:20001 of https://codereview.chromium.org/977013003/)

Reason for revert:
Spike in OOM crashes: crbug.com/403113

Original issue's description:
> Remove promotion backup case and report OOM instead.
>
> There are no test cases for this piece of code and it is really hard to test. If this rare case triggers, we are anyway in an OOM situation and would crash probably soon afterwards.
>
> BUG=
>
> Committed: https://crrev.com/e813afaf127ab80290153ab676dc07212bdc8946
> Cr-Commit-Position: refs/heads/master@{#27026}

TBR=mstarzinger@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1050113002

Cr-Commit-Position: refs/heads/master@{#27568}

The removed assertion consistently passes not because the invoked
`close` method internally throws a `TypeError` but because the `close`
method does not exist. The ES6 specification does not define a `close`
method on the GeneratorPrototype, so this test is a tautology.

BUG=None
LOG=N
R=arv

Review URL: https://codereview.chromium.org/1046963002

Cr-Commit-Position: refs/heads/master@{#27567}

The modified assertions targeted the property descriptor for the
template object's first "cooked" value. The code immediately preceeding
these statements asserts these values.

Update the assertions to instead target the property descriptor for the
template object's first "raw" value (which are otherwise untested).

BUG=

Review URL: https://codereview.chromium.org/1049523003

Cr-Commit-Position: refs/heads/master@{#27566}

Revert of Add CHECKs  when updating pointers from the slots and store buffers (patchset #3 id:40001 of https://codereview.chromium.org/1035763002/)

Reason for revert:
Got one dev-channel with this. Should be enough.

Original issue's description:
> Add CHECKs  when updating pointers from the slots and store buffers
>
> We want to verify that we always overwrite heap objects with heap
> objects, and non-heap objects with non-heap objects
>
> BUG=chromium:452095
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/58fbcfac8ae82b1241f07e1b8ea81a5973514c11
> Cr-Commit-Position: refs/heads/master@{#27479}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:452095

Review URL: https://codereview.chromium.org/1052713002

Cr-Commit-Position: refs/heads/master@{#27565}

Revert of Correctly compute line numbers in functions from the function constructor. (patchset #5 id:80001 of https://codereview.chromium.org/701093003/)

Reason for revert:
Locations from New Function are broken in DevTools.

Original issue's description:
> Correctly compute line numbers in functions from the function constructor.
>
> R=aandrey@chromium.org
> BUG=chromium:109362
> LOG=Y
>
> Committed: https://code.google.com/p/v8/source/detail?r=25289

TBR=aandrey@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/1053563002

Cr-Commit-Position: refs/heads/master@{#27564}

       [-h] [-g GIT_DIR] hash

positional arguments:
  hash                  Hash of the commit to be searched.

optional arguments:
  -h, --help            show this help message and exit
  -g GIT_DIR, --git-dir GIT_DIR
                        The path to your git working directory.

BUG=

Review URL: https://codereview.chromium.org/1033043002

Cr-Commit-Position: refs/heads/master@{#27563}

Revert of Fix JSON parser Handle leak (patchset #3 id:40001 of https://codereview.chromium.org/1041483004/)

Reason for revert:
Reverting due to JSOn parser failures

Original issue's description:
> Fix JSON parser Handle leak
>
> R=verwaest@chromium.org
> BUG=v8:3976
> LOG=y
>
> Committed: https://crrev.com/1ec850383bb82f6d8bebc7416e5f50b649d1eeaa
> Cr-Commit-Position: refs/heads/master@{#27512}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3976

Review URL: https://codereview.chromium.org/1052593002

Cr-Commit-Position: refs/heads/master@{#27562}

Revert of Relax assert a little to fix flake on regress-3976 (patchset #1 id:1 of https://codereview.chromium.org/1045763002/)

Reason for revert:
Reverting due to JSOn parser failures

Original issue's description:
> Relax assert a little to fix flake on regress-3976
>
> R=verwaest@chromium.org
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/b20edd7772892ff8b2b280b35e521fbc2cc4a5f6
> Cr-Commit-Position: refs/heads/master@{#27515}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1050033003

Cr-Commit-Position: refs/heads/master@{#27561}

Cr-Commit-Position: refs/heads/master@{#27560}

This commit is to fix the linking error:
  ../../v8/src/base/platform/platform-posix.cc:418: error: undefined reference to '__android_log_vprint'

Review URL: https://codereview.chromium.org/1037193003

Cr-Commit-Position: refs/heads/master@{#27559}

This reverts commit 992751d0.

The final spec for Object.getPrototypeOf calls ToObject on the
parameter, which means that it should only throw for null and
undefined. For other non object values the prototype of the wrapper
should be used.

Difference from last time: Updated .status and will disable Blink
side tests as needed.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1051523003

Cr-Commit-Position: refs/heads/master@{#27558}

It triggers once per context that calls observe (or attempts to access
any observation metadata, e.g. through Object.getNotifier).

Review URL: https://codereview.chromium.org/1048213002

Cr-Commit-Position: refs/heads/master@{#27557}

TEST=test-assembler-mips/MIPS16
BUG=

Review URL: https://codereview.chromium.org/1047223002

Cr-Commit-Position: refs/heads/master@{#27556}