In the frame elider, we were propagating marks if both up and down
propagations were causing a change. We should do it until neither
changes.

BUG=

Review URL: https://codereview.chromium.org/1818503002

Cr-Commit-Position: refs/heads/master@{#35013}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1827523005

Cr-Commit-Position: refs/heads/master@{#35012}

The value projection of the Add/SubWithOverflow must be scheduled after
the Branch that dispatches based on overflow in order for the
instruction selector to be able to combine the addition/subtraction with
the branching.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1827463003

Cr-Commit-Position: refs/heads/master@{#35011}

Port 7ec8ecce

LOG=N
R=bbudge@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4124

Review URL: https://codereview.chromium.org/1825643002

Cr-Commit-Position: refs/heads/master@{#35010}

Rolling v8/tools/clang to f5219dd53ee7a87a07085ce03083456231ba0c27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1825283005

Cr-Commit-Position: refs/heads/master@{#35009}

The warning notes that we'd want a 'w' register here because the size of
the operand is 32-bit, however, the instruction only takes an 'x'
register and so force that using the 'x' modifier on the instruction.

BUG=

Review URL: https://codereview.chromium.org/1817963003

Cr-Commit-Position: refs/heads/master@{#35008}

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1820293002

Cr-Commit-Position: refs/heads/master@{#35007}

Port 9536c388

R=verwaest@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1824133002

Cr-Commit-Position: refs/heads/master@{#35006}

Port 75ed4a60
R=verwaest@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1825623002

Cr-Commit-Position: refs/heads/master@{#35005}

Port b7aa4c3a

Original commit message:
    Split ToNumberStub into the entry ToNumberStub, and two new stubs,
    StringToNumberStub and NonNumberToNumberStub, which can be used when we
    already know something about the input (i.e. in various branches of the
    code stubs, or in TurboFan graphs).

    Also introduce an appropriate StringToNumber simplified operator for
    TurboFan, that is pure and is lowered to an invocation of the newly
    added StringToNumberStub.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1825593003

Cr-Commit-Position: refs/heads/master@{#35004}

Port acbb968d
Port 66e22b79

Original commit messages:
    In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
    Otherwise we will see G in a stack trace inside H.

    This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

    Always generate lazy bailout points for tail calls because Debugger could still require them to inspect optimized frames.

R=ishell@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1820373002

Cr-Commit-Position: refs/heads/master@{#35003}

Now that ES2015 const has shipped, in Chrome 49, legacy const declarations
are no more. This lets us remove a bunch of code from many parts of the
codebase.

In this patch, I remove parser support for generating legacy const variables
from const declarations. This also removes the special "illegal declaration"
bit from Scope, which has ripples into all compiler backends.

Also gone are any tests which relied on legacy const declarations.

Note that we do still generate a Variable in mode CONST_LEGACY in one case:
function name bindings in sloppy mode. The likely fix there is to add a new
Variable::Kind for this case and handle it appropriately for stores in each
backend, but I leave that for a later patch to make this one completely
subtractive.

Review URL: https://codereview.chromium.org/1819123002

Cr-Commit-Position: refs/heads/master@{#35002}

String.prototype.match is specified to call out to the current
value of RegExp.prototype[Symbol.match] when passed a string argument,
rather than the original value. This patch updates the RegExp code
to do that.

R=yangguo@chromium.org
BUG=v8:4602
LOG=Y

Review URL: https://codereview.chromium.org/1821773003

Cr-Commit-Position: refs/heads/master@{#35001}

The 'key' value being passed into an array access should
be sign-extended on 64-bit platforms before being used to
index into memory.  Otherwise, garbage in the upper 32-bits
may result in a segmentation fault.

Minor fix to DoFlooringDivI to enforce 32-bit operations for calculation.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1822103002

Cr-Commit-Position: refs/heads/master@{#35000}

Port 1134688c

Original commit message:
    This roughly doubles performance for generic Array.prototype.push.

R=verwaest@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1823103002

Cr-Commit-Position: refs/heads/master@{#34999}

Port b7aa4c3a

Original commit message:
    Split ToNumberStub into the entry ToNumberStub, and two new stubs,
    StringToNumberStub and NonNumberToNumberStub, which can be used when we
    already know something about the input (i.e. in various branches of the
    code stubs, or in TurboFan graphs).

    Also introduce an appropriate StringToNumber simplified operator for
    TurboFan, that is pure and is lowered to an invocation of the newly
    added StringToNumberStub.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1826483002

Cr-Commit-Position: refs/heads/master@{#34998}

Port b6419fa2

Original commit message:
    Now implemented as a builtin that delegates to the InstanceOfStub. That
    stub was parameterized to fallback to either Runtime_InstanceOf or to
    Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
    Once the feature stabilizes and the flag is no longer needed, we can get
    rid of this parameterization again.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1825083002

Cr-Commit-Position: refs/heads/master@{#34997}

Port acbb968d
Port 66e22b79

Original commit messages:
    In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
    Otherwise we will see G in a stack trace inside H.

    This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

    Always generate lazy bailout points for tail calls because Debugger could still require them to inspect optimized frames.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1825513002

Cr-Commit-Position: refs/heads/master@{#34996}

Revert of [es6] Ship new ES6 instanceof operator semantics. (patchset #1 id:1 of https://codereview.chromium.org/1820903002/ )

Reason for revert:
Breaks two layout tests when rolling into Chromium. Tests needs investigation and most likely a rebaseline. The following are the tests that fail:

- imported/web-platform-tests/html/semantics/text-level-semantics/the-time-element/001.html
- fast/dom/Window/window-postmessage-clone-deep-array.html

https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64/5594/layout-test-results/results.html

Original issue's description:
> [es6] Ship new ES6 instanceof operator semantics.
>
> R=hablich@chromium.org
> BUG=v8:4447
> LOG=n
>
> Committed: https://crrev.com/5836807ea89b96ecfb4bbd8febf0d67bb8dae9ed
> Cr-Commit-Position: refs/heads/master@{#34984}

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4447

Review URL: https://codereview.chromium.org/1823813003

Cr-Commit-Position: refs/heads/master@{#34995}

This adds two new stubs, AddStub and SubtractStub, for the plus and the
minus operators, and hooks them up with TurboFan and Ignition.
Especially the addition case is very heavy and we might want to look
into splitting that up further into specialized stubs (similar to what
we did with ToNumberStub recently).

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1823083002

Cr-Commit-Position: refs/heads/master@{#34994}

Cleanup, and matches Chromium's build.

Review URL: https://codereview.chromium.org/1820583002

Cr-Commit-Position: refs/heads/master@{#34993}

BUG=v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1782743003

Cr-Commit-Position: refs/heads/master@{#34992}

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1821183002

Cr-Commit-Position: refs/heads/master@{#34991}

Otherwise, no handler would be dumped when using a snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1821663002

Cr-Commit-Position: refs/heads/master@{#34990}

This CL adds support for builtins with JavaScript linkage written using
the TurboFan CodeStubAssembler, but with a JSCall descriptor (which was
already supported thanks to a previous patch by Ben Smith). As a first
example, we convert the Math.sqrt builtin and thereby get rid of the
%_MathSqrt intrinsic, which causes trouble for the representation
selection pass in the JavaScript pipeline.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1824993002

Cr-Commit-Position: refs/heads/master@{#34989}

* Not jump around all memory to gather whether we need to profile
* Cache this information and dispatch to a templatized function

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1820263002

Cr-Commit-Position: refs/heads/master@{#34988}

This roughly doubles performance for generic Array.prototype.push.

BUG=

Review URL: https://codereview.chromium.org/1816553002

Cr-Commit-Position: refs/heads/master@{#34987}

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1819073003

Cr-Commit-Position: refs/heads/master@{#34986}

The linter (i.e. cpplint.py) no longer needs to check for alpha-sorted
include directives because our source formatting (i.e. clang-format)
will take care of this by now. This is the current default configuration
of the underlying linter anyways.

Note that the two tools disagree about the correct ordering about files
containing dash characters. The ordering suggested by the formatter is
more natural. Having the formatter trigger linter errors is not a good
situation to be in.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1822003002

Cr-Commit-Position: refs/heads/master@{#34985}

R=hablich@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1820903002

Cr-Commit-Position: refs/heads/master@{#34984}

Introduces a bytecode whose handler executes the equivalent of %_IsArray and %_IsJSReceiver without a runtime call.

BUG=v8:4822
LOG=y

Review URL: https://codereview.chromium.org/1645763003

Cr-Commit-Position: refs/heads/master@{#34983}

Fixes CopyBytecodeArray to set the interrupt_budget field.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1809123003

Cr-Commit-Position: refs/heads/master@{#34982}

The JSFunction::PassesFilter predicate is not fine-grained enough to
actually distinguish different closures and hence can be changed into
SharedFunctionInfo::PassesFilter instead. This will allow the compiler
to use is more broadly.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1823033002

Cr-Commit-Position: refs/heads/master@{#34981}

BUG=

Review URL: https://codereview.chromium.org/1806283004

Cr-Commit-Position: refs/heads/master@{#34980}

... because Debugger could still require them to inspect optimized frames.

BUG=chromium:596473, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1816113002

Cr-Commit-Position: refs/heads/master@{#34979}

The idiv instruction has 2 registers as output. This needs to be
modeled so that the move optimizer won't incorrectly elide away
moves.

BUG=

Review URL: https://codereview.chromium.org/1818323002

Cr-Commit-Position: refs/heads/master@{#34978}

The CL also add guard nodes to places where we assume that certain
values are numbers.

Review URL: https://codereview.chromium.org/1821133002

Cr-Commit-Position: refs/heads/master@{#34977}

This was once meant to be used for JavaScript code stubs, but since we
found a better way to do code stubs using TurboFan, we don't need this
runtime entry and intrinsic anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1821123002

Cr-Commit-Position: refs/heads/master@{#34976}

  port b6419fa2 (r34959)

  original commit message:
  Now implemented as a builtin that delegates to the InstanceOfStub. That
  stub was parameterized to fallback to either Runtime_InstanceOf or to
  Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
  Once the feature stabilizes and the flag is no longer needed, we can get
  rid of this parameterization again.

BUG=

Review URL: https://codereview.chromium.org/1821113002

Cr-Commit-Position: refs/heads/master@{#34975}

  port 22523f25 (r34925)

  original commit message:
  This is in preparation for a CL that does the equivalent of http://crrev.com/1780193003 for ia32.

BUG=

Review URL: https://codereview.chromium.org/1823943002

Cr-Commit-Position: refs/heads/master@{#34974}