Cr-Commit-Position: refs/heads/master@{#32611}

Fix the missed store buffer entries for live objects on aborted pages. Marking
the page as scan_on_scavenge takes care of rebuilding the entries. Note that
this requires an additional case in the rebuilding logic as we cannot iterate an
aborted pages using the object layout, but rather have to use mark bits for
this.

BUG=chromium:524425, chromium:564498
LOG=N

Review URL: https://codereview.chromium.org/1497883003

Cr-Commit-Position: refs/heads/master@{#32610}

NOTRY=true

Review URL: https://codereview.chromium.org/1496303002

Cr-Commit-Position: refs/heads/master@{#32609}

For now, we revoke a proxy by setting its handler to null (as in the spec).

Change the "target" field from Object to JSReceiver as there's no point in
allowing more.

R=jkummerow@chromium.org, rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1496243003

Cr-Commit-Position: refs/heads/master@{#32608}

Revert of [debugger] do not predict step in target for liveedit. (patchset #2 id:20001 of https://codereview.chromium.org/1491743005/ )

Reason for revert:
[Sheriff] And it still breaks:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3239

Please run chromium trybots on relands of CLs that broke chromium bots.

Original issue's description:
> [debugger] do not predict step in target for liveedit.
>
> R=verwaest@chromium.org
>
> Committed: https://crrev.com/8f87ff5d62e996b07ffbde7e735daa603c1d7290
> Cr-Commit-Position: refs/heads/master@{#32553}
>
> Committed: https://crrev.com/00559c4584fe3a4c3c1a8d3a5b5af0611b19c40a
> Cr-Commit-Position: refs/heads/master@{#32600}

TBR=verwaest@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1498523008

Cr-Commit-Position: refs/heads/master@{#32607}

Revert of [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors. (patchset #2 id:20001 of https://codereview.chromium.org/1500543002/ )

Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
>
> The ArrayBuffer and SharedArrayBuffer constructors should raise an
> exception when called with no arguments or undefined length.  Also
> unified the ArrayBuffer and SharedArrayBuffer implementations as C++
> builtins, and removed some (now) obsolete runtime entries.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/3235ccbb7826ceec2188f6ebab98fc851b54f60e
> Cr-Commit-Position: refs/heads/master@{#32590}

TBR=yangguo@chromium.org,cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1501673002

Cr-Commit-Position: refs/heads/master@{#32606}

Revert of [es6] Match ArrayBuffer constructor behavior of Firefox. (patchset #1 id:1 of https://codereview.chromium.org/1497163002/ )

Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Match ArrayBuffer constructor behavior of Firefox.
>
> We choose to deliberately violate the ES2015 specification and implement
> the ArrayBuffer constructor in a way that matches Firefox and Safari
> instead.
>
> BUG=v8:4592
> LOG=n
>
> Committed: https://crrev.com/8aae841ce26f01f3535e54af3a58fb7c65833eb7
> Cr-Commit-Position: refs/heads/master@{#32597}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4592

Review URL: https://codereview.chromium.org/1496293002

Cr-Commit-Position: refs/heads/master@{#32605}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1496263002

Cr-Commit-Position: refs/heads/master@{#32604}

BUG=chromium:565306
LOG=NO

Review URL: https://codereview.chromium.org/1497743003

Cr-Commit-Position: refs/heads/master@{#32603}

BUG=

Review URL: https://codereview.chromium.org/1496253002

Cr-Commit-Position: refs/heads/master@{#32602}

BUG=

Review URL: https://codereview.chromium.org/1496873002

Cr-Commit-Position: refs/heads/master@{#32601}

R=verwaest@chromium.org

Committed: https://crrev.com/8f87ff5d62e996b07ffbde7e735daa603c1d7290
Cr-Commit-Position: refs/heads/master@{#32553}

Review URL: https://codereview.chromium.org/1491743005

Cr-Commit-Position: refs/heads/master@{#32600}

Revert of Provide call counts for constructor calls, surface them as a vector IC. (patchset #4 id:60001 of https://codereview.chromium.org/1476413003/ )

Reason for revert:
Seems to be (mostly) responsible for the most recent Speedometer regression, not 100% sure. Let's see what the bots have to say.

Original issue's description:
> Provide call counts for constructor calls, surface them as a vector IC.
>
> CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that there is a request to make CallConstructStub look analogous. Enter ConstructICStub.
>
> BUG=
>
> Committed: https://crrev.com/66d5a9df62da458a51e8c7ed1811dc9660f4f418
> Cr-Commit-Position: refs/heads/master@{#32452}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1489413006

Cr-Commit-Position: refs/heads/master@{#32599}

Reland of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset #1 id:1 of https://codereview.chromium.org/1494283002/ )

Reason for revert:
Did not help...

Original issue's description:
> Revert of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset #2 id:20001 of https://codereview.chromium.org/1492863002/ )
>
> Reason for revert:
> [Sheriff] Speculative revert for:
> https://uberchromegw.corp.google.com/i/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225
>
> Can just be relanded if it doesn't get green.
>
> Original issue's description:
> > [proxies] Make Object.prototype.isPrototypeOf step into proxies.
> >
> > R=rossberg, verwaest@chromium.org
> > BUG=v8:1543
> > LOG=n
> >
> > Committed: https://crrev.com/4ca1180d2e7c409312ae0761cb12843989466573
> > Cr-Commit-Position: refs/heads/master@{#32569}
>
> TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:1543
>
> Committed: https://crrev.com/48fba9439f291edd5929e19951262dc7e8a09609
> Cr-Commit-Position: refs/heads/master@{#32588}

TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1491743010

Cr-Commit-Position: refs/heads/master@{#32598}

We choose to deliberately violate the ES2015 specification and implement
the ArrayBuffer constructor in a way that matches Firefox and Safari
instead.

BUG=v8:4592
LOG=n

Review URL: https://codereview.chromium.org/1497163002

Cr-Commit-Position: refs/heads/master@{#32597}

The expression Number(x) is essentially equivalent to ToNumber(x),
so just lower to JSToNumber in the JSCallReducer and let typing
and typed lowering take care of optimizations.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1497903002

Cr-Commit-Position: refs/heads/master@{#32596}

  port 57117b83 (r32308)

  original commit message:
  The Float32RoundTiesEven operator rounds float32 numbers towards the nearest
  integer. If the distance to two integers is the same, then the result is
  the even integer. This is the default rounding mode of the ieee 754 floating
  point standard.

  I implemented the optional Float32RoundTiesEven operator on x64, ia32, arm, and arm64.

BUG=

Review URL: https://codereview.chromium.org/1492293002

Cr-Commit-Position: refs/heads/master@{#32595}

  port a330af0e (r32539)

  original commit message:
  The optimized code generated by Crankshaft cannot properly deal
  with proxies (in the prototype chain), and there's probably no
  point in trying to make that work^Wfast with Crankshaft at all.
  TurboFan will handle that properly; Crankshaft just bails out
  to fullcodegen, which then goes to the runtime, which should do
  the right thing soon.

BUG=

Review URL: https://codereview.chromium.org/1495803003

Cr-Commit-Position: refs/heads/master@{#32594}

Rolling v8/buildtools to b747a9e091cb8212a62343258406eaf53a6c032e

Rolling v8/tools/clang to 58b11d197b1c5fec39a6ec374c21b3d3a5bf557b

Rolling v8/tools/swarming_client to 9cdd76171e517a430a72dcd7d66ade67e109aa00

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1493273004

Cr-Commit-Position: refs/heads/master@{#32593}

Review URL: https://codereview.chromium.org/1493373003

Cr-Commit-Position: refs/heads/master@{#32592}

Port 5d38d681

Original commit message:
    It didn't support subclassing case at all and in non-subclassing case the runtime
    allocation didn't do the slack tracking step.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:563339
LOG=N

Review URL: https://codereview.chromium.org/1493553007

Cr-Commit-Position: refs/heads/master@{#32591}

The ArrayBuffer and SharedArrayBuffer constructors should raise an
exception when called with no arguments or undefined length.  Also
unified the ArrayBuffer and SharedArrayBuffer implementations as C++
builtins, and removed some (now) obsolete runtime entries.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1500543002

Cr-Commit-Position: refs/heads/master@{#32590}

Port 6fca8702

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1497793002

Cr-Commit-Position: refs/heads/master@{#32589}

Revert of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset #2 id:20001 of https://codereview.chromium.org/1492863002/ )

Reason for revert:
[Sheriff] Speculative revert for:
https://uberchromegw.corp.google.com/i/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225

Can just be relanded if it doesn't get green.

Original issue's description:
> [proxies] Make Object.prototype.isPrototypeOf step into proxies.
>
> R=rossberg, verwaest@chromium.org
> BUG=v8:1543
> LOG=n
>
> Committed: https://crrev.com/4ca1180d2e7c409312ae0761cb12843989466573
> Cr-Commit-Position: refs/heads/master@{#32569}

TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1494283002

Cr-Commit-Position: refs/heads/master@{#32588}

Reland of [debugger] do not restart frames that reference new.target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1493863004/ )

Reason for revert:
Didn't help...

Original issue's description:
> Revert of [debugger] do not restart frames that reference new.target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1493363002/ )
>
> Reason for revert:
> [Sheriff] Speculative revert for https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225
>
> Original issue's description:
> > [debugger] do not restart frames that reference new.target for liveedit.
> >
> > R=mstarzinger@chromium.org
> >
> > Committed: https://crrev.com/6fca870240bdbb07a365189b5eb0c98fa65b3682
> > Cr-Commit-Position: refs/heads/master@{#32572}
>
> TBR=mstarzinger@chromium.org,yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/1a61dab34b9849f3f70a42ce69317e22758c53a1
> Cr-Commit-Position: refs/heads/master@{#32582}

TBR=mstarzinger@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1492393003

Cr-Commit-Position: refs/heads/master@{#32587}

Port 0e956833

Original commit message:
    Whenever the InstanceOfStub finds a proxy (either passed as object or
    somewhere on the prototype chain), it should bailout to the
    %HasInPrototypeChain runtime function, which will do the right thing
    (soonish).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1495513004

Cr-Commit-Position: refs/heads/master@{#32586}

Port 440a42b7

Original commit message:
    This passes the new.target value in a register instead of through a
    side-channel via the construct stub. Note that this marks the last
    consumer of said side-channel and the special slot in the construct
    stub frame can be removed as a follow-up.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
TEST=mjsunit/es6/regress/regress-new-target-context
BUG=

Review URL: https://codereview.chromium.org/1494003004

Cr-Commit-Position: refs/heads/master@{#32585}

Port eaa0e596

Original commit message:
    This drops the specific slot containing the new.target value from our
    construct stub frames. This side-channel has been deprecated and will
    no longer be accessed by any consumers.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1494593005

Cr-Commit-Position: refs/heads/master@{#32584}

Port a330af0e

Original commit message:
    The optimized code generated by Crankshaft cannot properly deal
    with proxies (in the prototype chain), and there's probably no
    point in trying to make that work^Wfast with Crankshaft at all.
    TurboFan will handle that properly; Crankshaft just bails out
    to fullcodegen, which then goes to the runtime, which should do
    the right thing soon.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1496843004

Cr-Commit-Position: refs/heads/master@{#32583}

Revert of [debugger] do not restart frames that reference new.target for liveedit. (patchset #1 id:1 of https://codereview.chromium.org/1493363002/ )

Reason for revert:
[Sheriff] Speculative revert for https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225

Original issue's description:
> [debugger] do not restart frames that reference new.target for liveedit.
>
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/6fca870240bdbb07a365189b5eb0c98fa65b3682
> Cr-Commit-Position: refs/heads/master@{#32572}

TBR=mstarzinger@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1493863004

Cr-Commit-Position: refs/heads/master@{#32582}

Fix several operations in the parser that rewrite constant expressions
to preserve knowledge regarding whether a value originally contained a ".".
This information is required to accurately validate Asm.js typing.

Making the assumption that if either side of a binary operation contains
a dot, that the rewritten expression should be treated as a double for
Asm.js purposes. This is a slight deviation from the spec (which
would forbid mix type operations).

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator, test-parsing
R=titzer@chromium.org,marja@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1492123002

Cr-Commit-Position: refs/heads/master@{#32581}

BUG=

Review URL: https://codereview.chromium.org/1500683002

Cr-Commit-Position: refs/heads/master@{#32580}

R=rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1491863002

Cr-Commit-Position: refs/heads/master@{#32579}

R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1499573004

Cr-Commit-Position: refs/heads/master@{#32578}

I added a flag to the CallDescriptor which indicates that the native
stack should be used for a CallObject instead of the js stack on arm64.

Additionally I removed the use of EmitPrepareArguments because the
current implementation does not work when float and int parameters are
mixed. I plan to fix it in a future CL, because currently I have a
problem figuring out the type of a parameter.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1494123002

Cr-Commit-Position: refs/heads/master@{#32577}

Extract ToBoolean hints from the fullcodegen code object and put them
into the ToBoolean nodes created by the AstGraphBuilder.  We currently
do not yet consume this feedback, that will be done in a followup CL.

R=mstarzinger@chromium.org
BUG=v8:4583
LOG=n

Review URL: https://codereview.chromium.org/1494973002

Cr-Commit-Position: refs/heads/master@{#32576}

Warning in test-asm-validator.cc fixed by splitting the function causing the warning into two functions. This
is how it has been done earlier this way, e.g. https://codereview.chromium.org/1164893003

BUG=

Review URL: https://codereview.chromium.org/1491583002

Cr-Commit-Position: refs/heads/master@{#32575}

Reason for revert:
Probably causes GC stress test failures.

TBR=mvstanton@chromium.org
BUG=
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1493393002

Cr-Commit-Position: refs/heads/master@{#32574}

Embedders should use the factory method that takes an Isolate* instead

BUG=none
R=vogelheim@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1494503003

Cr-Commit-Position: refs/heads/master@{#32573}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1493363002

Cr-Commit-Position: refs/heads/master@{#32572}