Move replacements out of virtual object. Replacements are
global to the graph and are not dependent on the virtual
state (after they are discovered).

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1527533002

Cr-Commit-Position: refs/heads/master@{#32838}

This uses the same pipeline entry function for all three assemblers
currently supported by TurboFan. The Pipeline::GenerateCodeForCodeStub
is by now generic enough to accommodate all uses.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1521363003

Cr-Commit-Position: refs/heads/master@{#32837}

This CL makes proxy-related error messages more accurate and verbose.
(Exception: those used in deprecated functions in v8natives.js.)  Some of
the old error messages were simply wrong.

On the side, fix ShouldThrow semantics of JSProxy::SetPrototype and
JSProxy::DefineOwnProperty.

R=cbruni@chromium.org, jkummerow@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1527583002

Cr-Commit-Position: refs/heads/master@{#32836}

The parser reads one character beyond EOF to have an additional source
position that the rewriter can use to insert the implicit return
statement at the end of a script. If we break at that return statement,
we need to be able to translate the source position to line and
column number.

R=jkummerow@chromium.org
BUG=chromium:569514
LOG=N

Committed: https://crrev.com/0b1076a68e1eadba260cec8afc5acec618561c28
Cr-Commit-Position: refs/heads/master@{#32825}

Review URL: https://codereview.chromium.org/1521953003

Cr-Commit-Position: refs/heads/master@{#32835}

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1514123002

Cr-Commit-Position: refs/heads/master@{#32834}

Bugfixes and improvements in escape analysis include:

* Handling of ObjectIsSmi (non-escaping)
* Handling of nested phi replacements
* Handling of phis with arity > 2
* Resilience against effectful nodes dangling from start
* Allocations escape now, if non-const load/store is performed
* Fixed a bug where non-allocated objects where tracked
* Allow fixed double arrays to be tracked

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1510973006

Cr-Commit-Position: refs/heads/master@{#32833}

BUG=v8:1543
LOG=N
R=cbruni@chromium.org,jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1519073002

Cr-Commit-Position: refs/heads/master@{#32832}

R=littledan@chromium.org, rossberg@chromium.org
BUG=v8:4545
LOG=Y

Review URL: https://codereview.chromium.org/1512253003

Cr-Commit-Position: refs/heads/master@{#32830}

Revert of [debugger] correctly find source position of implicit return statement. (patchset #1 id:1 of https://codereview.chromium.org/1521953003/ )

Reason for revert:
Layout test failures: https://chromegw.corp.google.com/i/client.v8.fyi/builders/V8-Blink%20Mac/builds/2732/steps/webkit_tests%20%28with%20patch%29/logs/stdio

Original issue's description:
> [debugger] correctly find source position of implicit return statement.
>
> The parser reads one character beyond EOF to have an additional source
> position that the rewriter can use to insert the implicit return
> statement at the end of a script. If we break at that return statement,
> we need to be able to translate the source position to line and
> column number.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/0b1076a68e1eadba260cec8afc5acec618561c28
> Cr-Commit-Position: refs/heads/master@{#32825}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1526583002

Cr-Commit-Position: refs/heads/master@{#32829}

Debug-evaluate used to resolve stack variables that shadow
context variables incorrectly, since the stack variable is
not visible in the context chain.

To fix this, we limit local variables accessible by debug-
evaluate to the ones directly referenced inside the function.
What is not referenced by the function itself, is considered
optimized out and not accessible by debug-evaluate.

To achieve this, we duplicate the entire context chain up to
the native context, and write back changes after debug-
evaluate. Changes to the original context chain will however
be overwritten. This already happens for catch and block
scopes though.

Also fix a crash caused by declaring variables inside debug-
evaluate.

R=mstarzinger@chromium.org
BUG=v8:4593
LOG=N

Review URL: https://codereview.chromium.org/1500933002

Cr-Commit-Position: refs/heads/master@{#32828}

BUG=v8:4344
LOG=N
R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1506353009

Cr-Commit-Position: refs/heads/master@{#32827}

R=littledan@chromium.org
BUG=v8:4342
LOG=Y

Review URL: https://codereview.chromium.org/1509733010

Cr-Commit-Position: refs/heads/master@{#32826}

The parser reads one character beyond EOF to have an additional source
position that the rewriter can use to insert the implicit return
statement at the end of a script. If we break at that return statement,
we need to be able to translate the source position to line and
column number.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1521953003

Cr-Commit-Position: refs/heads/master@{#32825}

Since the parser now desugars super constructor calls to simple
primitives, we can also easily optimize those in fullcodegen w/
just a few simple lines of native code per architecture.  This
code in particular should be fast, so it seems worth the code
in fullcodegen.

BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1524673002

Cr-Commit-Position: refs/heads/master@{#32823}

Invalidate the instanceof cache in proxy-case of InstanceOfStub
after the changes in https://codereview.chromium.org/1492243003.

This didn't have a test case until https://codereview.chromium.org/1518773003

TEST=mjsunit/es6/instanceof-proxies.js
BUG=

Review URL: https://codereview.chromium.org/1519303002

Cr-Commit-Position: refs/heads/master@{#32821}

TEST=cctest/test-run-machops/RunInt32DivP,
     mjsunit/asm/uint32div
BUG=

Review URL: https://codereview.chromium.org/1517243004

Cr-Commit-Position: refs/heads/master@{#32820}

Array.prototype.includes shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1513843006

Cr-Commit-Position: refs/heads/master@{#32818}

This is behind the --harmony-function-name flag, currently disabled.

With the flag enabled, we now pass the relevant tests in
language/statements/*/fn-name-*.

BUG=v8:3699
LOG=y

Review URL: https://codereview.chromium.org/1518873004

Cr-Commit-Position: refs/heads/master@{#32817}

It shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1519073004

Cr-Commit-Position: refs/heads/master@{#32816}

BUG=chromium:552100
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1515473004

Cr-Commit-Position: refs/heads/master@{#32815}

BUG=v8:811, v8:4599
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1517973002

Cr-Commit-Position: refs/heads/master@{#32814}

Review URL: https://codereview.chromium.org/1514323002

Cr-Commit-Position: refs/heads/master@{#32813}

During property reconfiguring ensure that the first map that gets new descriptors is the one that owns the whole descriptor array.

This is necessary to guarantee that the whole descriptor would be marked, otherwise DescriptorArray pretenuring would cause crashes.

Review URL: https://codereview.chromium.org/1520613006

Cr-Commit-Position: refs/heads/master@{#32812}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1519823002

Cr-Commit-Position: refs/heads/master@{#32811}

Instead desugar the default constructor for derived classes using the
same mechanism we use for normal super constructor calls.

TBR=rossberg@chromium.org
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1517243002

Cr-Commit-Position: refs/heads/master@{#32810}

BUG=

Review URL: https://codereview.chromium.org/1514693010

Cr-Commit-Position: refs/heads/master@{#32808}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1514913003

Cr-Commit-Position: refs/heads/master@{#32807}

BUG=

Review URL: https://codereview.chromium.org/1517673002

Cr-Commit-Position: refs/heads/master@{#32806}

Review URL: https://codereview.chromium.org/1517753003

Cr-Commit-Position: refs/heads/master@{#32805}

The %GetPrototype runtime function does a lot more than the
GetSuperConstructor specified in ES6 12.3.5.2. So this introduces a
proper %_GetSuperConstructor instead with support in TurboFan.

R=jarin@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1522503002

Cr-Commit-Position: refs/heads/master@{#32804}

Review URL: https://codereview.chromium.org/1513383003

Cr-Commit-Position: refs/heads/master@{#32803}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1516143004

Cr-Commit-Position: refs/heads/master@{#32802}

[proxy] fixing for-in for proxies, fixing harmony/proxy.js tests, improving error messages and some drive-by fixes

BUG=v8:1543
LOG=n

patch from issue 1519473002 at patchset 1 (http://crrev.com/1519473002#ps1)

Review URL: https://codereview.chromium.org/1516843002

Cr-Commit-Position: refs/heads/master@{#32801}

Before this change traps always returned a 32 bit word in tests. With this
change traps return either a 32 bit word or a64 bit word, depending on the size
of the actual return value of the test.

Additionally this CL implements the wasm instructions I64SCONVERTF32,
I64UCONVERTF32, I64SCONVERTF64, and I64UCONVERTF64.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1519013003

Cr-Commit-Position: refs/heads/master@{#32800}

This avoids a pair of super-high-degree polymorphic load/store ICs, and
creates the opportunity to add more fast paths if needed.

Review URL: https://codereview.chromium.org/1517963002

Cr-Commit-Position: refs/heads/master@{#32799}

This relands this, in it's new home:
https://github.com/WebAssembly/v8-native-prototype/commit/032faa8a902f6555980e8848ca28208b0333d974

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1522473002

Cr-Commit-Position: refs/heads/master@{#32798}

Arguments objects can have packed elements too.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1517073003

Cr-Commit-Position: refs/heads/master@{#32797}

TryTruncateFloat32ToUint64 converts a float32 to a uint64. Additionally it
provides an optional second return value which indicates whether the conversion
succeeded (i.e. float32 value was within uint64 range) or not.

I implemented the new operator on x64, arm64, and mips64. @v8-ppc-ports, can you
please take care of the ppc64 implementation of the second output?

Additionally I fixed a bug on x64 and mips64 in the implementation of
TryTruncateFloat64ToUint64. Cases where the input value was between -1 and 0
were handled incorrectly.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1512023002

Cr-Commit-Position: refs/heads/master@{#32796}

As discussed in person, this adds the code from v8-native-prototype into
V8 proper, guarded by GYP flags that do not build the code by default.
Passing wasm=on to 'make' or setting v8_wasm as a GYP flag activates
building of this code.

An additional header file is added to and exported from the compiler
directory, src/compiler/wasm-compiler.h. This exposes a limited interface
with opaque Node and Graph types to the decoder to build TF graphs, as
well as functions to compile WASM graphs.

The mjsunit tests added are blacklisted because they fail without the
WASM object exposed to JS, which is also disabled by the build config
option.

This corresponds closely to https://github.com/WebAssembly/v8-native-prototype/commit/5981e06ebc9b1e578831d03100f17ebb77970ee0, with some formatting fixes and moving some files into src/compiler.

R=mstarzinger@chromium.org, bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1504713014

Cr-Commit-Position: refs/heads/master@{#32794}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1521573002

Cr-Commit-Position: refs/heads/master@{#32793}