The msan configuration can be used in combination with
v8_use_snapshot=false.

BUG=chromium:425187
LOG=n

Review URL: https://codereview.chromium.org/802583003

Cr-Commit-Position: refs/heads/master@{#28064}

Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer. (patchset #10 id:180001 of https://codereview.chromium.org/1063513003/)

Reason for revert:
[sheriff] Breaks nosnap debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/156

Original issue's description:
> [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
>
> Uses lazy deoptimization and code dependencies to introduce loads
> from property cells and also to promote globals to constants.
>
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://crrev.com/aae4a62d07e839455b1d0ad4fa512cc5d48a1a68
> Cr-Commit-Position: refs/heads/master@{#28057}

TBR=mstarzinger@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1084533003

Cr-Commit-Position: refs/heads/master@{#28063}

This uses explicit operators instead of intrinsic runtime calls to
create literals froms boilerplates. It allows for easier access of
static parameters and syncs it with other allocating operators.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1104453006

Cr-Commit-Position: refs/heads/master@{#28062}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1109733002

Cr-Commit-Position: refs/heads/master@{#28061}

Original description:
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1107843002

Cr-Commit-Position: refs/heads/master@{#28060}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1084243005

Cr-Commit-Position: refs/heads/master@{#28059}

This introduces a JSCreateClosure operator which can be lowered by the
typed pipeline to the aforementioned stub. It also allows for further
optimizations of closure creation.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1105513002

Cr-Commit-Position: refs/heads/master@{#28058}

Uses lazy deoptimization and code dependencies to introduce loads
from property cells and also to promote globals to constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1063513003

Cr-Commit-Position: refs/heads/master@{#28057}

If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}

BUG=

Review URL: https://codereview.chromium.org/1095203005

Cr-Commit-Position: refs/heads/master@{#28055}

This changes the unittests suite to be run in only the default variant,
because unit tests are (and should be) written to be independent from
global flags.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1067863007

Cr-Commit-Position: refs/heads/master@{#28054}

When splitting live ranges between interval boundary,
the intervals still link eachother. This fixes that.

BUG=

Review URL: https://codereview.chromium.org/1102243002

Cr-Commit-Position: refs/heads/master@{#28053}

Rolling v8/tools/clang to cb9ddad752c487e2f4df2bf32df70daaa9afded5

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1103043002

Cr-Commit-Position: refs/heads/master@{#28052}

Rolling v8/buildtools to 15308f469a704c45d15567fa69cd94ce07ad0e1b

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1107773002

Cr-Commit-Position: refs/heads/master@{#28051}

This reverts commit d5565c1f.

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

This also moves the logic for handling symbols from runtime-function.cc
to v8natives.js.

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1093183006

Cr-Commit-Position: refs/heads/master@{#28050}

Revert of Lazily register prototype users (patchset #2 id:20001 of https://codereview.chromium.org/1104813004/)

Reason for revert:
Suspected of causing GC stress failures.

Original issue's description:
> Lazily register prototype users
>
> when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
> Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.
>
> Committed: https://crrev.com/a4bb7643c076b014816431a9b85af3e2edf828e7
> Cr-Commit-Position: refs/heads/master@{#28047}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1108583002

Cr-Commit-Position: refs/heads/master@{#28049}

Follow up for r28032.

We don't need to store the "corresponding outer scope class variables", it's
enough if we transmit the declaration group start to the inner class
variable.

R=rossberg@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1102903002

Cr-Commit-Position: refs/heads/master@{#28048}

when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.

Review URL: https://codereview.chromium.org/1104813004

Cr-Commit-Position: refs/heads/master@{#28047}

BUG=

Review URL: https://codereview.chromium.org/1089853005

Cr-Commit-Position: refs/heads/master@{#28046}

Implements the strong mode proposal's restrictions on
implicit conversions for binary arithmetic operations, not
including the + special case. Adds some infrastructure
for future implementation of the restrictions for other
operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1092353002

Cr-Commit-Position: refs/heads/master@{#28045}

ClassVariable should always have the kind CLASS, let's not pretend there
are other options.

R=rossberg@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1106483003

Cr-Commit-Position: refs/heads/master@{#28044}

This introduces a bailout point for class literals right after the
%DefineClass function has been called. Otherwise the FrameState after
class literal evaluation might contain the literal itself.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-480819
BUG=chromium:480819
LOG=N

Review URL: https://codereview.chromium.org/1104673004

Cr-Commit-Position: refs/heads/master@{#28043}

Lolcode candidate: Both Expression and FunctionLiteral define an accessor is_parenthesized(), which access different flags. FunctionLiteral derives from Expression.

Given
      FunctionLiteral* a; a->is_parenthesized()
const FunctionLiteral* b; b->is_parenthesized()

the first accesses FunctionLiteral::IsParenthesized, the second accesses Expression::IsParenthesizedField.

Since these are distinct uses, we could rename them based on their use:
- Expression::is_parenthesized -> is_single_parenthesized
  Count # of parenthesis, for parsing & error handling:
  no parenthesis -> single parenthesis -> multi parenthesis
- FunctionLiteral::eager_compile_hint()
  Hint from parser to compiler about whether the parser suggests this function for eager compilation.

BUG=

Review URL: https://codereview.chromium.org/1097723005

Cr-Commit-Position: refs/heads/master@{#28042}

BUG=chromium:480807
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1101273002

Cr-Commit-Position: refs/heads/master@{#28041}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1096243003

Cr-Commit-Position: refs/heads/master@{#28040}

R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1105653002

Cr-Commit-Position: refs/heads/master@{#28039}

Revert of Reland "Remove the weak list of views from array buffers" (patchset #2 id:20001 of https://codereview.chromium.org/1093183004/)

Reason for revert:
still working on perf

Original issue's description:
> Reland "Remove the weak list of views from array buffers"
>
> Original description:
> > Instead, views have to check their array buffer for whether
> > it's neutered or not.
> >
> > BUG=v8:3996
> > R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> > LOG=n
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n
>
> Committed: https://crrev.com/655b04637e9da2749f53c866bca8f5f6abb05a3f
> Cr-Commit-Position: refs/heads/master@{#28029}

TBR=dslomov@chromium.org,hpayer@chromium.org,verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1053203007

Cr-Commit-Position: refs/heads/master@{#28038}

Revert of Eagerly declare eval scopes, even for sloppy scopes (patchset #2 id:20001 of https://codereview.chromium.org/1085263003/)

Reason for revert:
Regresses CodeLoad (crbug.com/480774).

Original issue's description:
> Eagerly declare eval scopes, even for sloppy scopes
>
> R=marja@chromium.org, mstarzinger@chromium.org
> LOG=N
> BUG=N
>
> Committed: https://crrev.com/fe9efc121c8cba8b6aee1a9cf36c68ee97c44d99
> Cr-Commit-Position: refs/heads/master@{#28027}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1082013003

Cr-Commit-Position: refs/heads/master@{#28037}

Rolling v8/tools/clang to ed8476f8e39660d1926dddff78cc8446527f9b9c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1079163012

Cr-Commit-Position: refs/heads/master@{#28036}

Revert of [es6] Map/Set size getter should have "get size" name (patchset #4 id:80001 of https://codereview.chromium.org/1094323005/)

Reason for revert:
Breaks GCMole ia32

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/1685/steps/GCMole%20ia32/logs/stdio

src/runtime/runtime-function.cc:96:3: warning: Possible problem with evaluation order.
  f->shared()->set_name(*NameToFunctionName(name));
  ^
src/runtime/runtime-function.cc:96:3: warning: Possible problem with evaluation order.
2 warnings generated.

Original issue's description:
> [es6] Map/Set size getter should have "get size" name
>
> Getter and setter function names in ES6 are defined as "get foo" and
> "set foo".
>
> BUG=None
> LOG=N
> R=adamk@chromium.org
>
> Committed: https://crrev.com/83c89a2e71a363afb35595f903423e650d788e42
> Cr-Commit-Position: refs/heads/master@{#28034}

TBR=adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=None

Review URL: https://codereview.chromium.org/1106713002

Cr-Commit-Position: refs/heads/master@{#28035}

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1094323005

Cr-Commit-Position: refs/heads/master@{#28034}

If the length of the array prototype is changed, be sure to turn off the
guarantee that it's elements are empty.

This case was missed in https://codereview.chromium.org/1092043002
("Protect the emptiness of Array prototype elements with a PropertyCell")

R=jkummerow@chromium.org
BUG=479781
LOG=N

Review URL: https://codereview.chromium.org/1099453007

Cr-Commit-Position: refs/heads/master@{#28033}

Add the restriction that both classes must be declared inside the same
consectutive class declaration batch.

Dependency analysis not implemented yet.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1060913005

Cr-Commit-Position: refs/heads/master@{#28032}

A strict arrow function with no parameters and no variable bindings
won't need a context object because it will never have any
locals.  (This is unlike strict normal functions, which do have
"arguments" and "this" locals.)

R=rossberg@chromium.org
BUG=v8:4056
LOG=N

Review URL: https://codereview.chromium.org/1093183003

Cr-Commit-Position: refs/heads/master@{#28031}

BUG=

Review URL: https://codereview.chromium.org/1087133004

Cr-Commit-Position: refs/heads/master@{#28030}

Original description:
> Instead, views have to check their array buffer for whether
> it's neutered or not.
>
> BUG=v8:3996
> R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1093183004

Cr-Commit-Position: refs/heads/master@{#28029}

The RawMachineAssembler now behaves like the rest of TurboFan,
removing the need for some special cases.

Review URL: https://codereview.chromium.org/1090393003

Cr-Commit-Position: refs/heads/master@{#28028}

R=marja@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=N

Review URL: https://codereview.chromium.org/1085263003

Cr-Commit-Position: refs/heads/master@{#28027}

Now all nodes that care about deoptimization always take frame state
inputs no matter whether deoptimization is enabled for a particular
function. In case that deoptimization is off, the AstGraphBuilder just
inserts the empty frame state. This greatly simplifies the logic in
various places and makes testing easier as well, and is probably the
first step towards enabling --turbo-deoptimization by default.

There seems to be no noticable performance impact on asm.js programs.

Also fix the graph replay in order to regenerate the scheduler unittests.

Review URL: https://codereview.chromium.org/1106613003

Cr-Commit-Position: refs/heads/master@{#28026}

BUG=

Review URL: https://codereview.chromium.org/1086563004

Cr-Commit-Position: refs/heads/master@{#28025}