BUG=chromium:479528
LOG=n

Review URL: https://codereview.chromium.org/1185373004

Cr-Commit-Position: refs/heads/master@{#29075}

BUG=chromium:500173
LOG=n

Review URL: https://codereview.chromium.org/1194513003

Cr-Commit-Position: refs/heads/master@{#29074}

Cr-Commit-Position: refs/heads/master@{#29073}

BUG=chromium:491907,chromium:499815
LOG=NO

Review URL: https://codereview.chromium.org/1180203003

Cr-Commit-Position: refs/heads/master@{#29072}

The remaining uses need some non-mechanical work:

  * non-standard-layout type, probably due to mixed access control

  * extended field designators

Review URL: https://codereview.chromium.org/1173343006

Cr-Commit-Position: refs/heads/master@{#29071}

Revert of Add %TypedArray% to proto chain (patchset #6 id:100001 of https://codereview.chromium.org/1186733002/)

Reason for revert:
[Sheriff] Changes layout tests:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/429

See e.g.:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/429/layout-test-results/inspector/console/console-big-array-pretty-diff.html

Please upload a blink side needsmanualrebaseline change first for these tests if the change is intended. Please also add a blink trybot on a reland of this CL.

Original issue's description:
> Add %TypedArray% to proto chain
>
> According to the ES6 spec, the main methods and getters shouldn't
> be properties of the individual TypedArray objects and prototypes
> but instead on %TypedArray% and %TypedArray%.prototype. This
> difference is observable through introspection. This patch moves
> some methods and getters to the proper place, with the exception
> of %TypedArray%.prototype.subarray and harmony methods. These will
> be moved in follow-on patches.
>
> BUG=v8:4085
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/a10590158260737b256fac3254b4939f48f90095
> Cr-Commit-Position: refs/heads/master@{#29057}

TBR=adamk@chromium.org,arv@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4085

Review URL: https://codereview.chromium.org/1192433003

Cr-Commit-Position: refs/heads/master@{#29070}

This fixes CodeGenerator::EnsureSpaceForLazyDeopt to no longer be
treated as a lazy deopt site in itself. Calls mark themselves as lazy
bailout sites in CodeGenerator::RecordCallPosition, which suffices.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1186353003

Cr-Commit-Position: refs/heads/master@{#29069}

Tests are already there in mjsuint/regress/regress-latin-1.js
R=yangguo@chromium.org
BUG=v8:3550
LOG=n

Review URL: https://codereview.chromium.org/1188793004

Cr-Commit-Position: refs/heads/master@{#29068}

Revert of Update test262-es6 to 6/11 (patchset #2 id:40001 of https://codereview.chromium.org/1175313003/)

Reason for revert:
[Sheriff] Please fix test expectations for nosnap before reland. There are 54 tests failing:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/3422

Original issue's description:
> Update test262-es6 to 6/11
>
> This reverts commit 67b16919 and picks
> up the fixes to the yaml parser upstream.
>
> BUG=N
> LOG=N
> R=adamk@chromium.org, machenbach@chromium.org
>
> Committed: https://crrev.com/bc847230610d0518a700a69546d23784e6ce3479
> Cr-Commit-Position: refs/heads/master@{#29056}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186093005

Cr-Commit-Position: refs/heads/master@{#29067}

Revert of Skip slow tests in non debug too (patchset #1 id:1 of https://codereview.chromium.org/1184923003/)

Reason for revert:
[Sheriff] Needed for reverting:
https://codereview.chromium.org/1175313003

Original issue's description:
> Skip slow tests in non debug too
>
> BUG=N
> LOG=N
> TBR=adamk
>
> Committed: https://crrev.com/17b0f16c760e5b0d51ae87742a864de93b6f4c0b
> Cr-Commit-Position: refs/heads/master@{#29058}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1177223004

Cr-Commit-Position: refs/heads/master@{#29066}

Revert of Serializer: clear string hash for code serializer. (patchset #1 id:1 of https://codereview.chromium.org/1183483006/)

Reason for revert:
This led to the roll being stuck: https://codereview.chromium.org/1189863003/

Original issue's description:
> Serializer: clear string hash for code serializer.
>
> R=jochen@chromium.org
> BUG=v8:4179
> LOG=N
>
> Committed: https://crrev.com/a0342678e865337215f9195f983c6013b60e7641
> Cr-Commit-Position: refs/heads/master@{#29016}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4179

Review URL: https://codereview.chromium.org/1186173004

Cr-Commit-Position: refs/heads/master@{#29065}

This optimization just duplicates part of the ToBoolean rule in the
Typer, and it doesn't make sense to have adhoc partial typing rules in
the ControlReducer anyway.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1189963002

Cr-Commit-Position: refs/heads/master@{#29064}

Revert "Revert of Decompiler improvements. (patchset #2 id:20001 of https://codereview.chromium.org/1177123002/)"

This reverts commit e2ce4681, avoiding the hex->dec changes, and re-introducing the block pretty printing of the original CL.

The hex-dec issue would be handled separately.
BUG=

Review URL: https://codereview.chromium.org/1186273005

Cr-Commit-Position: refs/heads/master@{#29063}

AstGraphBuilder::BuildToBoolean() can be optimized easily without types,
especially since the types are only present on some nodes during graph
building. So this optimization is both more efficient and more effective
at the same time. We will probably refactor this code into a separate
optimization method/class later.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1188503003

Cr-Commit-Position: refs/heads/master@{#29062}

This ensures there is a lazy bailout point at the entry of every
exception handler so that deoptimized code is not re-entered through
caught exceptions.

R=jarin@chromium.org
TEST=cctest/test-run-deopt/DeoptExceptionHandler

Review URL: https://codereview.chromium.org/1173253004

Cr-Commit-Position: refs/heads/master@{#29061}

Reason for revert:
[Sheriff] gyp change breaks calling gyp on XP:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/2849

Original issue's description:
> Update V8 DEPS.
>
> Rolling v8/build/gyp to fdcd8bc10c935eff13b391644b01460593c46861
>
> Rolling v8/tools/clang to 4cc9c6714533a07ba02ca01ed04557f055820532
>
> TBR=machenbach@chromium.org
>
> Committed: https://crrev.com/6e7e5e833c8bddf7d6a97cd3c01f0afe5a882bd6
> Cr-Commit-Position: refs/heads/master@{#29059}

TBR=v8-autoroll@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1180193003

Cr-Commit-Position: refs/heads/master@{#29060}

Rolling v8/build/gyp to fdcd8bc10c935eff13b391644b01460593c46861

Rolling v8/tools/clang to 4cc9c6714533a07ba02ca01ed04557f055820532

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1179703005

Cr-Commit-Position: refs/heads/master@{#29059}

BUG=N
LOG=N
TBR=adamk

Review URL: https://codereview.chromium.org/1184923003

Cr-Commit-Position: refs/heads/master@{#29058}

According to the ES6 spec, the main methods and getters shouldn't
be properties of the individual TypedArray objects and prototypes
but instead on %TypedArray% and %TypedArray%.prototype. This
difference is observable through introspection. This patch moves
some methods and getters to the proper place, with the exception
of %TypedArray%.prototype.subarray and harmony methods. These will
be moved in follow-on patches.

BUG=v8:4085
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1186733002

Cr-Commit-Position: refs/heads/master@{#29057}

This reverts commit 67b16919 and picks
up the fixes to the yaml parser upstream.

BUG=N
LOG=N
R=adamk@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1175313003

Cr-Commit-Position: refs/heads/master@{#29056}

BUG=v8:4183
R=arv@chromium.org, rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1184373002

Cr-Commit-Position: refs/heads/master@{#29055}

Opportunistically removed GreedyAllocator::TryReuseSpillForPhi because it is actually unsuitable for Greedy. It was copied from Linear and it relies on hints, however, the current implementation of hints assumes linear scan.

This change doesn't aim to address performance nor correctness for Greedy.

BUG=

Review URL: https://codereview.chromium.org/1184183002

Cr-Commit-Position: refs/heads/master@{#29054}

BUG=

Review URL: https://codereview.chromium.org/1180263006

Cr-Commit-Position: refs/heads/master@{#29053}

BUG=

Review URL: https://codereview.chromium.org/1153233003

Cr-Commit-Position: refs/heads/master@{#29052}

LOG=n

Review URL: https://codereview.chromium.org/1183743003

Cr-Commit-Position: refs/heads/master@{#29051}

crrev.com/1177163002 should have fixed the issues that broke this last time.

Notes:
- The current functionality is meant to stay. If you prefer the old way,
  just set v8_use_external_startup_data=0.
- You might notice this if you call d8 via PATH. Either explicitly tell d8
  where your external snapshot/built-ins are, or change the build options
  as above.
- This follows Chromium practice, that mostly uses this feature these days.
- Other platforms to follow later.

BUG=

Review URL: https://codereview.chromium.org/1189563004

Cr-Commit-Position: refs/heads/master@{#29050}

    This patch includes the following changes.
     1, Enable the turbofan backend support for X87 platform. It depends on previous CL: 3fdfebd2.
     2, Enable the test cases which are disabled because turbofan for X87 was not enabled.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1179763004

Cr-Commit-Position: refs/heads/master@{#29049}

frame->GetExpression always returns the same function. We should iterate through expression stack when we use Function.call.apply for finding actual target.

LOG=N
BUG=chromium:499479
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1182703003

Cr-Commit-Position: refs/heads/master@{#29048}

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
Cr-Commit-Position: refs/heads/master@{#29044}

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29047}

Revert of Decompiler improvements. (patchset #2 id:20001 of https://codereview.chromium.org/1177123002/)

Reason for revert:
Code printout has become unreadable. Offsets are printed in decimal numbers everywhere else. This is inconsistent with the rest of the code-base. Some examples are tables for deoptimization data, safepoints and exception handlers. I would be fine with this change if _all_ tracing would be adapted. But there are _many_ places to touch.

Original issue's description:
> Decompiler improvements.
>
> The main motivation is simplifying profiling activities:
>
> 1) Use hex instead of decimal for offsets, just like perf does. This
> affects --print-opt-code
>
> 2) When printing block information, indicate loop information: if
> block is header, where the end is; if block is in a loop, where the
> loop starts. This affects --code-comments.
>
> Using --print-opt-code --code-comments, and cross-referencing with data
> obtained from perf, one may now find the block a hotspot belongs to
> without needing to do hex2dec/dec2hex conversions. Once found, loop info
> is available locally, on the block.
>
> BUG=
>
> Committed: https://crrev.com/32f4bd659d38eb5485eedb1d0dd236ff1bdc01d5
> Cr-Commit-Position: refs/heads/master@{#28964}

TBR=jarin@chromium.org,stichnot@chromium.org,jvoung@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1188093002

Cr-Commit-Position: refs/heads/master@{#29046}

Revert of Serializer: support all alignment kinds. (patchset #3 id:40001 of https://codereview.chromium.org/1179873003/)

Reason for revert:
[Sheriff] Breaks arm debug compile:
http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/4308

Original issue's description:
> Serializer: support all alignment kinds.
>
> We use an alignment prefix for unusual alignment kinds (not kWordAligned).
> This will cause new objects to be aligned in ReadObject, and back references
> to be aligned to skip padding.
>
> The motivation to change the undefined next sentinel in WeakCell is this:
> When the deserializer aligns an object, it requires filler maps to already
> exist to create filler objects as padding. However, deserializing the
> filler map leads to deserializing NaN, which as heap number is aligned:
> filler map > meta map > weak cell cache > undefined > NaN
> If we use the-hole instead of undefined as sentinel, it works.
>
> R=jochen@chromium.org,bbudge@chromium.org
> BUG=v8:4178
> LOG=N
>
> Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
> Cr-Commit-Position: refs/heads/master@{#29044}

TBR=jochen@chromium.org,bbudge@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4178

Review URL: https://codereview.chromium.org/1173253006

Cr-Commit-Position: refs/heads/master@{#29045}

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29044}

BUG=chromium:500824
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186333002

Cr-Commit-Position: refs/heads/master@{#29043}

This fixes warning on android_arm build.
Previously the compiler complained about a check that can never be true.
See second check below(index is size_t type, FIRST_SPACE=0):
if (index > i::LAST_SPACE || index < i::FIRST_SPACE)
And make the code easy to understand.

BUG=

Review URL: https://codereview.chromium.org/1155043005

Cr-Commit-Position: refs/heads/master@{#29042}

R=rossberg@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1182303004

Cr-Commit-Position: refs/heads/master@{#29041}

R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}

This is the first step towards unifying external and on-heap typed arrays.

The end-state will be that this base pointer either points to the on-heap values
or to the externally allocated array buffer.

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1176263004

Cr-Commit-Position: refs/heads/master@{#29039}

This invariant will save us some head ache.
The changes to test-debug/DebugStub is due to the fact that it abuses
the ability to set break points in code that has no debug break slots.
This is now no longer possible.

R=ulan@chromium.org
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1181013007

Cr-Commit-Position: refs/heads/master@{#29038}

Using TranslatedState and friends is too expensive compared to the low
level TranslationIterator, because some code (i.e. in Speedometer)
depends on the OptimizedFrame summary/function listing to be very fast.

BUG=chromium:499338
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181373003

Cr-Commit-Position: refs/heads/master@{#29037}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186573004

Cr-Commit-Position: refs/heads/master@{#29036}