R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1156393002

Cr-Commit-Position: refs/heads/master@{#28675}

The control flow optimization should work independent of the JSGraph. We
used the JSGraph there because it was convinient, not because it was
necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1160863003

Cr-Commit-Position: refs/heads/master@{#28674}

The SimplifiedOperatorReducer is (mostly) unused, except for the very
rough store elimination, and just eats compilation time.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1162563002

Cr-Commit-Position: refs/heads/master@{#28673}

The list of inlined functions is used in exactly two places - for live
edit and to prevent code flushing for inlined functions - and those are
fine with SharedFunctionInfo and don't require a closure.

This is one additional step towards inlining based on SharedFunctionInfo
instead of JSFunction.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1145893003

Cr-Commit-Position: refs/heads/master@{#28672}

R=arv@chromium.org
BUG=chromium:492526
LOG=N

Review URL: https://codereview.chromium.org/1146923004

Cr-Commit-Position: refs/heads/master@{#28671}

R=mstarzinger@chromium.org
BUG=chromium:490680
LOG=Y

Review URL: https://codereview.chromium.org/1157563005

Cr-Commit-Position: refs/heads/master@{#28670}

Neither the increment nor the comparison can deoptimize, so we don't
need proper frame states there.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1148323003

Cr-Commit-Position: refs/heads/master@{#28669}

Rolling v8/build/gyp to 29e94a3285ee899d14d5e56a6001682620d3778f

Rolling v8/tools/clang to dc8f173e7fe10badbd9e29cd6eadc32ec552e691

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1156373003

Cr-Commit-Position: refs/heads/master@{#28668}

This test is little-endian specific and therefore it can't run
correctly on big-endian platforms.

BUG=

Review URL: https://codereview.chromium.org/1155113008

Cr-Commit-Position: refs/heads/master@{#28667}

Port 5450fc07

Original commit message:
Also adapt code generation to pass the slot to the
store/keyed-store ic. AST nodes ObjectLiteral, Assignment,
ForEach, Call and CountOperation now include one or more
feedback vector ic slot ids.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1156503003

Cr-Commit-Position: refs/heads/master@{#28666}

Port 44e98103

Original commit message:
When we enter a method that needs access to the [[HomeObject]]
we allocate a local variable `.home_object` and assign it the
value from the [[HomeObject]] private symbol. Something along
the lines of:

  method() {
    var .home_object = %ThisFunction()[home_object_symbol];
    ...
  }

R=arv@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1161603004

Cr-Commit-Position: refs/heads/master@{#28665}

Implements the strong mode proposal's restrictions on the ability of user code
to modify the prototype of strong objects.

Setting the strong bit is still wip, so this change will only affect those
objects that have the bit correctly set. The tests reflect this, and will be
expanded as more objects can be marked as strong.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1143623002

Cr-Commit-Position: refs/heads/master@{#28664}

BUG=chromium:489254
LOG=n

Review URL: https://codereview.chromium.org/1158903002

Cr-Commit-Position: refs/heads/master@{#28663}

Make sure that when manual evacuation candidate selection is enabled we do not select more pages than requested.
BUG=

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1157293002

Cr-Commit-Position: refs/heads/master@{#28662}

The DCHECK was a lie. The idea was that - when a bookmark is set -
the scanner must clearly be at a character boundary and hence the
bookmark does not need to save a 'partial' UTF-8 code point. The
first part is true - the Scanner is always at a character boundary -
but the 'partial' UTF-8 code point is at the end of a block, not at
the current character position of the Scanner.
Hence, the 'partial' character needs to be saved as well.

jkummerow: Thanks for noticing.

BUG=chromium:470930
R=jochen@chromium.org, jkummerow@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1154773004

Cr-Commit-Position: refs/heads/master@{#28661}

Also deprecate ForceSet

BUG=chromium:475206
R=adamk@chromium.org,verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1154233003

Cr-Commit-Position: refs/heads/master@{#28660}

Also adapt code generation to pass the slot to the
store/keyed-store ic. AST nodes ObjectLiteral, Assignment,
ForEach, Call and CountOperation now include one or more
feedback vector ic slot ids.

BUG=

Review URL: https://codereview.chromium.org/1161623002

Cr-Commit-Position: refs/heads/master@{#28659}

BUG=

Review URL: https://codereview.chromium.org/1152153004

Cr-Commit-Position: refs/heads/master@{#28658}

Rolling v8/buildtools to a85661f97e83c620a8a1d0255829eb7a674e12cc

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1145043004

Cr-Commit-Position: refs/heads/master@{#28657}

Revert of Use CLOCK_REALTIME_COARSE when available. (patchset #1 id:1 of https://codereview.chromium.org/1151283005/)

Reason for revert:
[Sheriff] This leads to several failures in chromium and blocks our roll:
https://codereview.chromium.org/1154363002/

Bisect (https://codereview.chromium.org/1152553004/) points to this CL.

Please add the failing chromium trybot on a reland of this CL.

Original issue's description:
> Use CLOCK_REALTIME_COARSE when available.
>
> On systems that have CLOCK_REALTIME_COARSE with good enough resolution,
> we can avoid making a system call to get the current time; it's serviced
> from the vDSO.
>
> This is v2 of the patch.  v1 can be found at [0] but was reverted in [1]
> because of Chromium sandbox restrictions.  The necessary changes have
> been applied upstream in [2].
>
> [0] https://codereview.chromium.org/1125003002
> [1] https://codereview.chromium.org/1130083003
> [2] https://codereview.chromium.org/1133653002
>
> BUG=
> LOG=N
>
> Committed: https://crrev.com/28cea2b749f24ba33e6e0c8e343dd0d6258ee302
> Cr-Commit-Position: refs/heads/master@{#28639}

TBR=jochen@chromium.org,bmeurer@chromium.org,ben@strongloop.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1154783003

Cr-Commit-Position: refs/heads/master@{#28656}

Strong Object/Array literals are currently being created with incorrect
internal prototypes. This CL fixes this and extends the test suite to check.

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1158933002

Cr-Commit-Position: refs/heads/master@{#28655}

BUG=

Review URL: https://codereview.chromium.org/1153103003

Cr-Commit-Position: refs/heads/master@{#28654}

R=jkummerow@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1157683007

Cr-Commit-Position: refs/heads/master@{#28653}

Before we used to scale the growing factor based on freed global handles (which may have caused jank when many global handles got freed on site navigation).

BUG=

Review URL: https://codereview.chromium.org/1158433003

Cr-Commit-Position: refs/heads/master@{#28652}

This lifts the sqrt(n) limit on number of evacuation candidates,
replaces O(n * sqrt(n)) algorithm with O(n*log(n)) algorithm, and
removes hard-coded constants.

Evacuation candidates are selected as follows:

1) Sort pages from the most free to the least free.

2) Select the first m pages as evacuation candidates such that m is as
large as possible under the two conditions:

- The total size of live objects in the first m pages does not exceed
the given limit. This is based on the assumption that the evacuation cost is
proportional to the total size of moved objects.

- The fragmentation of the (m+1)-th page does not exceed the given
limit.

Review URL: https://codereview.chromium.org/1038313003

Cr-Commit-Position: refs/heads/master@{#28651}

And delete remnants of non-vectorized LoadICs from the type feedback oracle

Review URL: https://codereview.chromium.org/1147253004

Cr-Commit-Position: refs/heads/master@{#28650}

This simplifies inlining, in that we only need to update uses of Start
and inputs of End instead of walking the whole inlinee to update all
outer frame states.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1146403008

Cr-Commit-Position: refs/heads/master@{#28649}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1160683003

Cr-Commit-Position: refs/heads/master@{#28648}

TBR=machenbach@chromium.org
BUG=chromium:470930
LOG=N

Review URL: https://codereview.chromium.org/1149923006

Cr-Commit-Position: refs/heads/master@{#28647}

If both inputs to JSStrictEqual/JSStrictNotEqual are unique values (i.e.
values with a canonical representation), we can lower the comparison to
ReferenceEqual instead of StringEqual or CompareIC.

Review URL: https://codereview.chromium.org/1154303002

Cr-Commit-Position: refs/heads/master@{#28646}

Rolling v8/third_party/icu to f1ad7f9ba957571dc692ea3e187612c685615e19

Rolling v8/tools/clang to dbc958e1b51949ca815ca31a8f9bf4a760ca1d35

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1160693002

Cr-Commit-Position: refs/heads/master@{#28645}

When we enter a method that needs access to the [[HomeObject]]
we allocate a local variable `.home_object` and assign it the
value from the [[HomeObject]] private symbol. Something along
the lines of:

  method() {
    var .home_object = %ThisFunction()[home_object_symbol];
    ...
  }

BUG=v8:3867, v8:4031
LOG=N

Review URL: https://codereview.chromium.org/1135243004

Cr-Commit-Position: refs/heads/master@{#28644}

TBR=jkummerow@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1156133006

Cr-Commit-Position: refs/heads/master@{#28643}

These are similar to the Map/Set constructors when called with an array,
except that they are guaranteed to be side-effect free if called with
a packed array.

This will be useful in implementing structured clone which, as
specified in HTML, speaks in terms of the internal [[MapData]]
and [[SetData]] slots without going through the exposed iteration
ES semantics.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1155893003

Cr-Commit-Position: refs/heads/master@{#28642}

The April 14 2015 final draft of the ES6 specification states that the
`prototype` property of generator function instances should be writable.

BUG=v8:4140, v8:4140
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1153633003

Cr-Commit-Position: refs/heads/master@{#28641}

These return arrays representing the current contents of the given
Map/Set. They are similar to what would be returned by the JS code:

  Array.from(collection)

except that they are guaranteed side-effect free.

This will be useful in implementing structured clone which, as
specified in HTML, speaks in terms of the internal [[MapData]]
and [[SetData]] slots without going through the exposed iteration
ES semantics.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1148383007

Cr-Commit-Position: refs/heads/master@{#28640}

On systems that have CLOCK_REALTIME_COARSE with good enough resolution,
we can avoid making a system call to get the current time; it's serviced
from the vDSO.

This is v2 of the patch.  v1 can be found at [0] but was reverted in [1]
because of Chromium sandbox restrictions.  The necessary changes have
been applied upstream in [2].

[0] https://codereview.chromium.org/1125003002
[1] https://codereview.chromium.org/1130083003
[2] https://codereview.chromium.org/1133653002

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1151283005

Cr-Commit-Position: refs/heads/master@{#28639}

BUG=chromium:492021
LOG=n

Review URL: https://codereview.chromium.org/1148953009

Cr-Commit-Position: refs/heads/master@{#28638}

Only supports constructing new objects and returning size.
Followup patch will need to add ability to retrieve and
set contents in order to support structured clone.

Also removes a bunch of outdated "experimental" markers from v8.h.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1157453002

Cr-Commit-Position: refs/heads/master@{#28637}

Port a86384f1

Original commit message:
Also introduce new interface descriptors for the trampoline and full
versions of those stubs.

Currently, the stubs aren't functional.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1159483003

Cr-Commit-Position: refs/heads/master@{#28636}