Port 146598f4

Original commit message:
Optimistically pushing a lot of arguments can run into the stack limit of the process, at least on operating systems where this limit is close to the limit that V8 sets for itself.

BUG=chromium:469768
LOG=y

Review URL: https://codereview.chromium.org/1066843003

Cr-Commit-Position: refs/heads/master@{#27634}

This enables eager optimization of top-level code with TurboFan and
extends test coverage by triggering it with the --always-opt flag.
Script contexts are now also properly allocated in TurboFan.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1053063003

Cr-Commit-Position: refs/heads/master@{#27633}

BUG=
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1068723006

Cr-Commit-Position: refs/heads/master@{#27632}

Thanks to some careful assumptions, we can examine the object found at
vector[slot] and trust it's a heap object where the second field is
either a map if it's a WeakCell, or definitely not a map if it's a
Symbol, String or FixedArray. Use this to save a memory read.

BUG=

Review URL: https://codereview.chromium.org/1032163002

Cr-Commit-Position: refs/heads/master@{#27631}

BUG=

Review URL: https://codereview.chromium.org/1057613003

Cr-Commit-Position: refs/heads/master@{#27630}

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1060683003

Cr-Commit-Position: refs/heads/master@{#27629}

Revert of CpuProfiler: public API for deopt info in cpu profiler. (patchset #6 id:150001 of https://codereview.chromium.org/1045753002/)

Reason for revert:
[Sheriff] Breaks compile here:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6115

Original issue's description:
> CpuProfiler: public API for deopt info in cpu profiler.
>
> BUG=chromium:452067
> LOG=n
>
> Committed: https://crrev.com/baf927ff5115ec62a6dad684b9232ed9d3960e3a
> Cr-Commit-Position: refs/heads/master@{#27626}

TBR=alph@chromium.org,jkummerow@chromium.org,svenpanne@chromium.org,yurys@chromium.org,loislo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:452067

Review URL: https://codereview.chromium.org/1062053004

Cr-Commit-Position: refs/heads/master@{#27628}

BUG=chromium:469768
LOG=n

Review URL: https://codereview.chromium.org/1061263003

Cr-Commit-Position: refs/heads/master@{#27627}

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1045753002

Cr-Commit-Position: refs/heads/master@{#27626}

Instead, please use v8::Isolate::RequestInterrupt to synchronize
to the main thread.

R=yurys@chromium.org
API=Removed v8::Debug::DebugBreakForCommand
LOG=Y

Review URL: https://codereview.chromium.org/1036863002

Cr-Commit-Position: refs/heads/master@{#27625}

Support sxtb and sxth extend operators on add and subtract, as we've
done for ubtx/h. This is similar to ARM support for sxtab/h.

BUG=

Review URL: https://codereview.chromium.org/1064813003

Cr-Commit-Position: refs/heads/master@{#27624}

This reverts commit cbfcee55.

BUG=

Review URL: https://codereview.chromium.org/1051233002

Cr-Commit-Position: refs/heads/master@{#27623}

In case the v8 revision in chromium was set to an older
revision that's not in the list of recent v8 releases, the
script will bail out too early. This changes iterates over
10 more revisions, which should cover all exceeding revisions
in branch period.

NOTRY=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1067793002

Cr-Commit-Position: refs/heads/master@{#27622}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1059903004

Cr-Commit-Position: refs/heads/master@{#27621}

This CL primarily makes the loop peeling algorithm more robust; it no longer damages the graph if the loops are improperly closed.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1052753004

Cr-Commit-Position: refs/heads/master@{#27620}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/966653002

Cr-Commit-Position: refs/heads/master@{#27619}

We can use xorps/xorpd on Intel CPUs to flip the sign bit. Ideally we'd
use an absolute 128-bit constant in the code object, as OCaml/GCC
does, however that requires 128-bit alignment for code objects,
which is not yet implemented. So for now we materialize the mask
inline.

As drive-by-fix, don't hardcode xmm0 as scratch double register.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1064833002

Cr-Commit-Position: refs/heads/master@{#27618}

The motivation is that we prefer to avoid creating internal properties, and we have a usable field on maps ("transitions", which is not used for prototype maps).
This CL also ensures the invariant that prototype maps are never shared, even if they are in dictionary mode.

Review URL: https://codereview.chromium.org/1033653002

Cr-Commit-Position: refs/heads/master@{#27617}

Revert of Turn off overapproximation of the weak closure again (patchset #1 id:1 of https://codereview.chromium.org/1050443002/)

Reason for revert:
this indeed drops the max major gc time considerable, so turn it back on

Original issue's description:
> Turn off overapproximation of the weak closure again
>
> As long as we still have to process global handles, the impact is not
> yet worthwhile
>
> BUG=v8:3862
> R=hpayer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/294cdc6aecbd7f76be68217da4b3d35901ebce4b
> Cr-Commit-Position: refs/heads/master@{#27570}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3862

Review URL: https://codereview.chromium.org/1068723003

Cr-Commit-Position: refs/heads/master@{#27616}

R=mstarzinger@chromium.org
BUG=chromium:469480
LOG=N

Review URL: https://codereview.chromium.org/1034173002

Cr-Commit-Position: refs/heads/master@{#27615}

Optimistically pushing a lot of arguments can run into the stack limit of the process, at least on operating systems where this limit is close to the limit that V8 sets for itself.

BUG=chromium:469768
LOG=y

Review URL: https://codereview.chromium.org/1056913003

Cr-Commit-Position: refs/heads/master@{#27614}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1054963002

Cr-Commit-Position: refs/heads/master@{#27613}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1056543002

Cr-Commit-Position: refs/heads/master@{#27612}

We can use xorps/xorpd on Intel CPUs to flip the sign bit. Ideally we'd
use a RIP-relative 128-bit constant in the code object, as OCaml/GCC
does, however that requires 128-bit alignment for code objects, which is
not yet implemented. So for now we materialize the mask inline.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1046893002

Cr-Commit-Position: refs/heads/master@{#27611}

Currently we only generate addresses in the range 2GiB to 4GiB, because
of a bug, when running in 64-bit mode. With this fix we now use the full
range 2GiB to 4096GiB.

BUG=v8:3997
LOG=n
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1051303003

Cr-Commit-Position: refs/heads/master@{#27610}

Now every FOR_EACH_INTRINSIC_FOO sub-macro corresponds to a
src/runtime/runtime-FOO.cc file, even the order of runtime functions
within that file has been preserved in the corresponding macro, thanks
to some eye-hurting for/clang/sed/grep madness. ;-)

BUG=v8:3947
LOG=n

Review URL: https://codereview.chromium.org/1056863002

Cr-Commit-Position: refs/heads/master@{#27609}

cctest/test-log/EquivalenceOfLoggingAndTraversal fails on
AIX because it does not correctly handle the full 64 bit
address space supported by AIX.  SKIP until the issue
is resolved.

	modified:   test/cctest/cctest.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1055183002

Cr-Commit-Position: refs/heads/master@{#27608}

Rolling v8/third_party/icu to 10834e84d250eb31a73496bfdb7923eaa43ead51

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1055173004

Cr-Commit-Position: refs/heads/master@{#27607}

TBR=arv@chromium.org

Review URL: https://codereview.chromium.org/1062853003

Cr-Commit-Position: refs/heads/master@{#27606}

Previously, the only optimized code path for Maps and Sets was for String keys.
This was achieved through an implementation of various complex operations
in Hydrogen. This approach was neither scalable nor forward-compatible.

This patch adds the necessary intrinsics to implement Maps and Sets almost entirely
in JS. The added intrinsics are:

  %_FixedArrayGet
  %_FixedArraySet
  %_TheHole
  %_JSCollectionGetTable
  %_StringGetRawHashField

With these additions, as well as a few changes to what's exposed as runtime functions,
most of the C++ code backing Maps and Sets is gone (including both runtime code in
objects.cc and Crankshaft in hydrogen.cc).

Review URL: https://codereview.chromium.org/947683002

Cr-Commit-Position: refs/heads/master@{#27605}

BUG=
TBR=machenbach@chromium.org,vogelheim@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1059433002

Cr-Commit-Position: refs/heads/master@{#27604}

From ES6 25.2.3 ("Properties of the GeneratorFunction Prototype
Object"):

> The GeneratorFunction prototype object is an ordinary object. It is
> not a function object and does not have an [[ECMAScriptCode]] internal
> slot or any other of the internal slots listed in Table 27 or Table
> 56.

Introduce one assertion for the value's type and additional tests for its
properties. Remove an invalid assertion that fails as a result of this
fix.

BUG=v8:3991
LOG=N

Review URL: https://codereview.chromium.org/1062633002

Cr-Commit-Position: refs/heads/master@{#27603}

These slots are invalid and can result in a broken offset when slot index and start of object are equal and are at the beginning of a cell.

Moreover, make DCHECKs CHECKs to catch bugs in the wild.

BUG=chromium:473174
LOG=n

Review URL: https://codereview.chromium.org/1051243004

Cr-Commit-Position: refs/heads/master@{#27602}

- Fixed single float register type instruction en[de]coding in assembler and disassembler.
- Added max and min instructions for r6 and corresponding tests.
- Fixed selection instruction for boundary cases in simulator.
- Update assembler tests to be more thorough wrt boundary cases.

TEST=cctest/test-assembler-mips64/MIPS17, MIPS18
     cctest/test-disasm-mips64/Type1
     cctest/test-assembler-mips/MIPS16, MIPS17
     cctest/test-disasm-mips/Type1
BUG=

Review URL: https://codereview.chromium.org/1057323002

Cr-Commit-Position: refs/heads/master@{#27601}

Rolling v8/third_party/icu to e4c31439828d356525b71ef81a6d61ea50d7d673

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1058383002

Cr-Commit-Position: refs/heads/master@{#27600}

The number of generated instructions per table entry is reduced from six to
two, or four in worst-case scenario.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1059213002

Cr-Commit-Position: refs/heads/master@{#27599}

Rolling v8/build/gyp to 2889664b9fa88cce175c5c7cdf207d28420a7412

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1057013003

Cr-Commit-Position: refs/heads/master@{#27598}

port 16ee5509 (r27536)

original commit message:

  Generate common StoreFastElementStubs ahead of time

BUG=

Review URL: https://codereview.chromium.org/1052413002

Cr-Commit-Position: refs/heads/master@{#27597}

port b134ae74 (r27581)

original commit message:

   v8:3539 - hold constructor feedback in weak cells

BUG=

Review URL: https://codereview.chromium.org/1051253004

Cr-Commit-Position: refs/heads/master@{#27596}

port 7c347c54 (r27511)

original commit message:

    A bug allows JSObject literals with elements to have the elements in the
    boilerplate modified.

BUG=

Review URL: https://codereview.chromium.org/1057883004

Cr-Commit-Position: refs/heads/master@{#27595}