LayoutDescriptorHelper is now able to calculate the length of contiguous regions of tagged/non-tagged fields.
This functionality is now used by both object visitor and store buffer.

TEST=cctest/test-unboxed-doubles

Review URL: https://codereview.chromium.org/726713003

Cr-Commit-Position: refs/heads/master@{#25816}

Revert of Call DisableInlineAllocation() in heap setup when flag inline_new is off. (patchset #1 id:1 of https://codereview.chromium.org/790353006/)

Reason for revert:
Fix Windows nosnap.

Original issue's description:
> Call DisableInlineAllocation() in heap setup when flag inline_new is off.
>
> BUG=

TBR=ulan@chromium.org,mstarzinger@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/794053003

Cr-Commit-Position: refs/heads/master@{#25815}

The ToNumberStub is now able to handle all plain primitives (Numbers,
Booleans, Null, Undefined and Strings) without context access.

TEST=cctest,mjsunit,unittests

Review URL: https://codereview.chromium.org/801333002

Cr-Commit-Position: refs/heads/master@{#25814}

BUG=

Review URL: https://codereview.chromium.org/790353006

Cr-Commit-Position: refs/heads/master@{#25813}

TEST=unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/801263002

Cr-Commit-Position: refs/heads/master@{#25812}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/806653003

Cr-Commit-Position: refs/heads/master@{#25811}

Review URL: https://codereview.chromium.org/805523002

Cr-Commit-Position: refs/heads/master@{#25810}

TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/788053003

Cr-Commit-Position: refs/heads/master@{#25809}

Add support for Symbol.isConcatSpreadable in Array.prototype.concat. This enables spreading non-Array objects with the symbol.

LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/771483002

Cr-Commit-Position: refs/heads/master@{#25808}

Review URL: https://codereview.chromium.org/795353008

Cr-Commit-Position: refs/heads/master@{#25807}

Such properties never notified prior to r21558, but the combination of
that change and r23163 led to sending notifications when they were
set via Object.defineProperty (but not when set via other means).

This also allows some cleanup in v8natives.js and objects.cc,
both of which were doing unnecessary contortions to produce the right
change records.

BUG=v8:3745
LOG=n

Review URL: https://codereview.chromium.org/791243002

Cr-Commit-Position: refs/heads/master@{#25806}

The Mac version of GetCurrentThreadId should be used when building the host
build of V8 on Android for Mac.

Review URL: https://codereview.chromium.org/799943003

Cr-Commit-Position: refs/heads/master@{#25805}

BUG=

Review URL: https://codereview.chromium.org/804543002

Cr-Commit-Position: refs/heads/master@{#25804}

FORCE_FIELD -> FORCE_IN_OBJECT,
ALLOW_AS_CONSTANT -> ALLOW_IN_DESCRIPTOR.

Review URL: https://codereview.chromium.org/799723003

Cr-Commit-Position: refs/heads/master@{#25803}

Review URL: https://codereview.chromium.org/801813002

Cr-Commit-Position: refs/heads/master@{#25802}

Reason for revert:
performance bots were unchanged by the original revert

Original issue's description:
> revert r25736
>
> R=bmeurer@chromium.org
>
> BUG=

TBR=bmeurer@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/787183003

Cr-Commit-Position: refs/heads/master@{#25801}

This patch finally allows running and passing tests with vector-based
Load and KeyedLoad ICs.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/767743002

Cr-Commit-Position: refs/heads/master@{#25800}

Rolling v8/buildtools to 4995faa4a7ad968f1fa1917c26edd5cea295582f

Rolling v8/tools/clang to 3569efa494f668b68bd13835ab4f197f6a51b84a

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/801783003

Cr-Commit-Position: refs/heads/master@{#25799}

Review URL: https://codereview.chromium.org/786193004

Cr-Commit-Position: refs/heads/master@{#25798}

Review URL: https://codereview.chromium.org/801783002

Cr-Commit-Position: refs/heads/master@{#25797}

We managed to access the scope_ member of CompilationInfo before its
containing object was actually constructed.

Rule of thumb: When constructing an object, never ever pass around
pointers to members which come later in the member initializer list,
you simply can't see locally if this might cause trouble or not.

Review URL: https://codereview.chromium.org/796363002

Cr-Commit-Position: refs/heads/master@{#25796}

R=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/803493002

Cr-Commit-Position: refs/heads/master@{#25795}

R=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/800493002

Cr-Commit-Position: refs/heads/master@{#25794}

TEST=mjsunit/compiler/regress-int32array-outofbounds-nan
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/803483002

Cr-Commit-Position: refs/heads/master@{#25793}

FINAL implies OVERRIDE, which in turn implies virtual, so there's no need to use
more than one of these. The Google C++ style guide even requires this, see
http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Inheritance.

While we're here, port r24662 to x87.

The net result is that v8 compiles again with a current clang.

BUG=v8:3753
LOG=y

Review URL: https://codereview.chromium.org/797943002

Cr-Commit-Position: refs/heads/master@{#25792}

BUG=

Review URL: https://codereview.chromium.org/794113004

Cr-Commit-Position: refs/heads/master@{#25791}

- Decouple JSBuiltinReducer from JSTypedLowering.
- Unify JSTypedLowering::ReduceJSToXXX() lowering.
- Cleanup several includes and forward declarations.
- Unify helper methods.

TEST=cctest
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/797903003

Cr-Commit-Position: refs/heads/master@{#25790}

Review URL: https://codereview.chromium.org/769113002

Cr-Commit-Position: refs/heads/master@{#25789}

Otherwise, V8 won't compile with the latest clang anymore

BUG=v8:3753
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/797583004

Cr-Commit-Position: refs/heads/master@{#25788}

Avoid explicitly branching to the false label on unordered when the condition
on the true branch will not catch the unordered case and let the code fall
through.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/794203003

Cr-Commit-Position: refs/heads/master@{#25787}

This reverts commit 8a6cbf0a.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/788313002

Cr-Commit-Position: refs/heads/master@{#25786}

A helpful utility which converts iterables and array-like objects into Arrays

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.from

LOG=Y
BUG=v8:3336
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/363833006

Cr-Commit-Position: refs/heads/master@{#25785}

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/794213002

Cr-Commit-Position: refs/heads/master@{#25784}

R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}

LOG=N
R=arv@chromium.org, dslomov@chromium.org, marja@chromium.org
BUG=

Review URL: https://codereview.chromium.org/792083002

Cr-Commit-Position: refs/heads/master@{#25782}

This allows the setting to be overridable by embedders,
at the cost of forcing embedders that don't build v8
using standalone.gypi to add this setting to their build
config.

BUG=chromium:421063
LOG=Y

Review URL: https://codereview.chromium.org/794583002

Cr-Commit-Position: refs/heads/master@{#25781}

It could happen that we shrink a live object on the main thread (e.g.
MigrateFastToSlow) while we're sweeping the same page. The main
thread first creates a filler object that the release-stores the new
map. Therefore it's important to barrier load the map word of live
objects from the sweeper thread.

BUG=none
R=ulan@chromium.org,hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/797623002

Cr-Commit-Position: refs/heads/master@{#25780}

Rolling v8/buildtools/clang_format/script to 81edd558fea5dd7855d67a1dc61db34ae8c1fd63

Rolling v8/buildtools to 05dd6a24723170d7c6ff35b537ee02947f619891

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/797613002

Cr-Commit-Position: refs/heads/master@{#25779}

DevTools expects 2 events on Promise.resolve()/Promise.reject():
creation & settlement. The first one was missing.

R=ulan@chromium.org, yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/792383003

Cr-Commit-Position: refs/heads/master@{#25778}

R=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/793323002

Cr-Commit-Position: refs/heads/master@{#25777}