port e678a0f9 (r31358)

    original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

BUG=

Review URL: https://codereview.chromium.org/1421803002

Cr-Commit-Position: refs/heads/master@{#31542}

    port 053e280c (r31319).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1420233002

Cr-Commit-Position: refs/heads/master@{#31541}

Cr-Commit-Position: refs/heads/master@{#31540}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413903003

Cr-Commit-Position: refs/heads/master@{#31539}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1413013003

Cr-Commit-Position: refs/heads/master@{#31538}

For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}

Rolling v8/tools/clang to 66f5328417331216569e8beb244fd887f62e8997

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1403423006

Cr-Commit-Position: refs/heads/master@{#31536}

Revert of Reland "Use C++ implementation of Object.definePropert{y,ies}" (patchset #2 id:20001 of https://codereview.chromium.org/1413123004/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> Reland "Use C++ implementation of Object.definePropert{y,ies}"
>
> This reverts commit 581ead5c.
>
> Committed: https://crrev.com/034f4a6ae14cd5c29ceddbdb8f9af179803ca793
> Cr-Commit-Position: refs/heads/master@{#31473}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421123002

Cr-Commit-Position: refs/heads/master@{#31535}

Revert of Introduce LookupIterator::Restart() and use it (patchset #2 id:20001 of https://codereview.chromium.org/1416053007/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Needed so the reverts applies cleanly and seems to be related to the offending CL.

Original issue's description:
> Introduce LookupIterator::Restart() and use it
>
> Committed: https://crrev.com/5676415b4add059b78f98a9a762d00c8d721dbcd
> Cr-Commit-Position: refs/heads/master@{#31483}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418213003

Cr-Commit-Position: refs/heads/master@{#31534}

Revert of OrdinaryDefineOwnProperty: always reset the LookupIterator before storing. (patchset #1 id:1 of https://codereview.chromium.org/1415823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> OrdinaryDefineOwnProperty: always reset the LookupIterator before storing.
>
> Committed: https://crrev.com/7bc5ce16ee9244869384cdf17ea2feb0a9dde9bd
> Cr-Commit-Position: refs/heads/master@{#31511}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1418303002

Cr-Commit-Position: refs/heads/master@{#31533}

Revert of GetOwnPropertyDescriptor: API-style accessors can throw, check for that. (patchset #1 id:1 of https://codereview.chromium.org/1412823003/ )

Reason for revert:
Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441

Original issue's description:
> GetOwnPropertyDescriptor: API-style accessors can throw, check for that.
>
> Committed: https://crrev.com/cbda86196b0b52694f50982ae3f1ac8e72056e6d
> Cr-Commit-Position: refs/heads/master@{#31522}

TBR=cbruni@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1421483004

Cr-Commit-Position: refs/heads/master@{#31532}

Revert of [Turbofan] Fix perf regression (patchset #1 id:1 of https://codereview.chromium.org/1412123009/ )

Reason for revert:
[sheriff] breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/4998

Original issue's description:
> [Turbofan] Fix perf regression introduced by per-range change.
>
> When the range ends just at the gap of a non-deferred block, the last
> instruction the range covers is in the predecessor. If that predecessor is
> a deferred block, before this CL, we would splinter the remainder of the
> range all the way to the end. That leads to inefficient codegen, because
> we still want a split inside the deferred block.
>
> Also, opportunistically added a trace before we splinter, for better
> diagnostics.
>
> BUG= chromium:546416
> LOG=N
>
> Committed: https://crrev.com/32b6e085e74a8fcf94a01d20740fe4fdede07a86
> Cr-Commit-Position: refs/heads/master@{#31529}

TBR=bmeurer@chromium.org,jarin@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= chromium:546416

Review URL: https://codereview.chromium.org/1412893007

Cr-Commit-Position: refs/heads/master@{#31531}

  The reason is when native_context_specialization flag is ture, X87 turbofan
  will hit the known issue that X87 will change a sNaN to qNaN by default. And
  then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

BUG=

Review URL: https://codereview.chromium.org/1414733004

Cr-Commit-Position: refs/heads/master@{#31530}

When the range ends just at the gap of a non-deferred block, the last
instruction the range covers is in the predecessor. If that predecessor is
a deferred block, before this CL, we would splinter the remainder of the
range all the way to the end. That leads to inefficient codegen, because
we still want a split inside the deferred block.

Also, opportunistically added a trace before we splinter, for better
diagnostics.

BUG= chromium:546416
LOG=N

Review URL: https://codereview.chromium.org/1412123009

Cr-Commit-Position: refs/heads/master@{#31529}

Review URL: https://codereview.chromium.org/1413663007

Cr-Commit-Position: refs/heads/master@{#31528}

Setting the prototype to whatever it currently is must succeed even if
the object is not extensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1423603002

Cr-Commit-Position: refs/heads/master@{#31527}

Fix aborting compaction for pages by doing two separate passes, one that scans
all live objects, and one that later on sweeps the page.

Detailed description see bug report.

BUG=chromium:539356,chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1413763011

Cr-Commit-Position: refs/heads/master@{#31526}

This patch switches sloppy-mode code from legacy const semantics
to ES2015 semantics. It is unknown how much of the web will be
broken by this; likely the patch will have to be reverted before
a branch happens.

BUG=v8:3739
LOG=Y
R=rossberg,adamk

Review URL: https://codereview.chromium.org/1420223003

Cr-Commit-Position: refs/heads/master@{#31525}

We don't need to have an (untested) fallback for the case that a
prototype map is not stable when specializing a named property,
because prototype maps are always stable (which is now guarded
by a DCHECK in CompilationDependencies).  Less (dead) code is
better code.

R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417973006

Cr-Commit-Position: refs/heads/master@{#31524}

BUG=

Review URL: https://codereview.chromium.org/1420253002

Cr-Commit-Position: refs/heads/master@{#31523}

Review URL: https://codereview.chromium.org/1412823003

Cr-Commit-Position: refs/heads/master@{#31522}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1425433002

Cr-Commit-Position: refs/heads/master@{#31521}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1423753002

Cr-Commit-Position: refs/heads/master@{#31520}

BUG=none
LOG=y
R=verwaest@chromium.org,bmeurer@chromium.org,rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review URL: https://codereview.chromium.org/1423723002

Cr-Commit-Position: refs/heads/master@{#31519}

    port 7557dc5a (r31312).

    original commit message:
    This change add a new bytecode for operator new and implements it using
    the Construct() builtin.

BUG=

Review URL: https://codereview.chromium.org/1423733002

Cr-Commit-Position: refs/heads/master@{#31518}

R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1407233006

Cr-Commit-Position: refs/heads/master@{#31517}

    port b3334087 (r31313).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1412893006

Cr-Commit-Position: refs/heads/master@{#31516}

Review URL: https://codereview.chromium.org/1412123006

Cr-Commit-Position: refs/heads/master@{#31515}

Reland of [turbofan] Fix and enable property stores. (patchset #1 id:1 of https://codereview.chromium.org/1414743005/ )

Reason for revert:
It is fixed.

Original issue's description:
> Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )
>
> Reason for revert:
> [Sheriff] Breaks benchmarks:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164
>
> Original issue's description:
> > [turbofan] Fix and enable property stores.
> >
> > Fix lookup for storing to properties, and also make sure we don't embed
> > deprecated map (using Map::TryUpdate).
> >
> > R=jarin@chromium.org
> > BUG=v8:4470
> > LOG=n
> >
> > Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> > Cr-Commit-Position: refs/heads/master@{#31509}
>
> TBR=jarin@chromium.org,bmeurer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4470
>
> Committed: https://crrev.com/50e5a7275f2bc93a8ae731acda0f7ac6e5e97c3c
> Cr-Commit-Position: refs/heads/master@{#31513}

TBR=jarin@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1421573003

Cr-Commit-Position: refs/heads/master@{#31514}

Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164

Original issue's description:
> [turbofan] Fix and enable property stores.
>
> Fix lookup for storing to properties, and also make sure we don't embed
> deprecated map (using Map::TryUpdate).
>
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> Cr-Commit-Position: refs/heads/master@{#31509}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1414743005

Cr-Commit-Position: refs/heads/master@{#31513}

TBR=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1424533002 .

Cr-Commit-Position: refs/heads/master@{#31512}

Review URL: https://codereview.chromium.org/1415823003

Cr-Commit-Position: refs/heads/master@{#31511}

This removes the requirement for handles as arguments, but also removes
concurrency support, which is not being used at the moment.

Supporting concurrency could be done by introducing a sibling class to
IdentityMap that includes RelocationLock on method calls.

R=bmeurer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1419563004

Cr-Commit-Position: refs/heads/master@{#31510}

Fix lookup for storing to properties, and also make sure we don't embed
deprecated map (using Map::TryUpdate).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1424523002

Cr-Commit-Position: refs/heads/master@{#31509}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1409363003

Cr-Commit-Position: refs/heads/master@{#31508}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1415283003

Cr-Commit-Position: refs/heads/master@{#31507}

    port 24622f5f (r31257).

    original commit message:

BUG=

Review URL: https://codereview.chromium.org/1415033004

Cr-Commit-Position: refs/heads/master@{#31506}

    port f2f46aff (r31242).

    original commit message:
    The lack of a vector slot for the keyed store operation in filling in
    non-constant array literal properties led to undesirable contortions in
    compilers downwind of full-codegen. The use of a single slot to initialize all
    the array elements is sufficient.

BUG=

Review URL: https://codereview.chromium.org/1422443004

Cr-Commit-Position: refs/heads/master@{#31505}

    port 2d4aeaad (r31204).

    original commit message:
    The stack manipulation was expensive. Two virtual registers are better.

BUG=

Review URL: https://codereview.chromium.org/1410573003

Cr-Commit-Position: refs/heads/master@{#31504}

    port 9c8262f1 (r31120).

    original commit message:
    When calling into C++ builtins, we need to make sure that the argument
    count register contains the correct number of arguments, otherwise the
    CEntryStub will not be able to leave the stack in the correct state.

BUG=

Review URL: https://codereview.chromium.org/1418533009

Cr-Commit-Position: refs/heads/master@{#31503}