Disable loads and stores to global vars through property cell shortcuts installed into parent script context.

The plan is to implement the same idea using vector IC machinery.

Review URL: https://codereview.chromium.org/1422463004

Cr-Commit-Position: refs/heads/master@{#31438}

This makes sure that initializing assignments of let-declared variables
perform an environment lookup and hence keep the variable alive. This is
needed because full-codegen contains debug code verifying the variable
is still inside the TDZ at the initializing assignment.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-variable-liveness-let
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1420573002

Cr-Commit-Position: refs/heads/master@{#31437}

This reverts commit cf71c28f.

Original message:

[heap] Divide available memory upon compaction tasks
- Fairly (round-robin) divide available memory upon compaction tasks.
- Ensure an upper limit (of memory) since dividing is O(n) for n free-space
  nodes.
- Refill from free lists managed by sweeper once a compaction space becomes
  empty.

Assumption for dividing memory: Memory in the free lists is sparse upon starting
compaction (which means that only few nodes are available), except for memory
reducer GCs, which happen in idle time though (so it's less of a problem).

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1415733004

Cr-Commit-Position: refs/heads/master@{#31436}

When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

This is a revert of the revert https://crrev.com/e41614a058426fb6102e4ab2dd4f98997f00c0fc
with a much-improved (though not yet perfect) Scope::ResetOuterScope
method which properly fixes not only the outer_scope_ pointer but also
fixes the inner_scope_ list in the relevant outer_scopes.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1414283002

Cr-Commit-Position: refs/heads/master@{#31435}

Also clean up the access check, which was doing too much.

This is in preparation of implementing Reflect.getPrototypeOf.

BUG=

Review URL: https://codereview.chromium.org/1402973002

Cr-Commit-Position: refs/heads/master@{#31434}

port d515e513(r31211).

contributed by zhengxing.li@intel.com

original commit message:
Previously, name conflicts between var and let declarations were only made into exceptions if they were visible at parse-time. This patch adds runtime checks so that sloppy-mode direct eval can't introduce conflicting var declarations. The change is implemented by traversing the scope chain when a direct eval introduces a var declaration to look for conflicting let declarations, up to the function boundary.

additional comment:
The original r31211 patch needs some additional changes for x87
1. Should use Smi::FromInt(variable->DeclarationPropertyAttributes())

BUG=

Review URL: https://codereview.chromium.org/1420683002

Cr-Commit-Position: refs/heads/master@{#31433}

This is in preparation of implementing Reflect.setPrototypeOf.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1409003005

Cr-Commit-Position: refs/heads/master@{#31432}

Ignore proxies for now.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397853005

Cr-Commit-Position: refs/heads/master@{#31431}

Revert "Revert of [turbofan] Splinter into one range.
(patchset #2 id:80001 of https://codereview.chromium.org/1391023007/ )"

This reverts commit 23a8837f.

Also added a CHECK in Merge to validate that splitting yields a different
range and thus advances the algorithm. Ran stress bots successfully. Likely my earlier change in Splintering addressed the stress test scenario
that was looping infinitely.

BUG=

Review URL: https://codereview.chromium.org/1406983004

Cr-Commit-Position: refs/heads/master@{#31430}

Rolling v8/build/gyp to 3f21260b43401553c37bb28090b65a75577d5b4e

Rolling v8/tools/swarming_client to b64f0423ee66e730b0ceb88de8b9b89a98d7b61a

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1417863002

Cr-Commit-Position: refs/heads/master@{#31429}

Adds an implementation of "do expression" parsing (https://webcache.googleusercontent.com/search?q=cache:MIGALjqPDNgJ:wiki.ecmascript.org/doku.php%3Fid%3Dstrawman:do_expressions+&cd=1&hl=en&ct=clnk&gl=us).

This feature provides a way to evaluate a block of statements within an expression context, producing the resulting completion value. This is very helpful for implementing certain language features via desugaring.

BUG=v8:4488
LOG=N
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1399893002

Cr-Commit-Position: refs/heads/master@{#31428}

This change defines a common config for clients of v8 that
need to define V8_USE_EXTERNAL_STARTUP_DATA in order for
client code to be compiled correctly.

R=brettw@chromium.org, jochen@chromium.org
BUG=541791
LOG=n

Review URL: https://codereview.chromium.org/1415773003

Cr-Commit-Position: refs/heads/master@{#31427}

TEST=
BUG=

Review URL: https://codereview.chromium.org/1408033003

Cr-Commit-Position: refs/heads/master@{#31426}

TBR=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413223007

Cr-Commit-Position: refs/heads/master@{#31425}

Revert of Use C++ implementation of Object.definePropert{y,ies} (patchset #4 id:60001 of https://codereview.chromium.org/1409613004/ )

Reason for revert:
[Sheriff] Breaks layout tests. Please request rebase upstream first if intended:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2427

One test times out now.

Original issue's description:
> Use C++ implementation of Object.definePropert{y,ies}
>
> For now, only rewire builtins in v8natives.js to call the new runtime functions.
>
> Committed: https://crrev.com/b2abc0e3ad4ce9dde8d66aab7aafae179e6948d4
> Cr-Commit-Position: refs/heads/master@{#31413}

TBR=verwaest@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1412893005

Cr-Commit-Position: refs/heads/master@{#31424}

R=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412573005

Cr-Commit-Position: refs/heads/master@{#31423}

range's internal structure, we take a range at a time and splinter based on
the blocks it covers. This is no different in scenarios where a UseInterval
covers non-deferred then deferred blocks. However, in scenarios where
a deferred block jumps to another one, and there are no other blocks
covered by the range in between, this CL will treat the two such blocks
together, while the previous one would treat them separately. This matters
in cases such as deoptimization blocks preceded (not necessarily
consecutively) by a single instruction (jump) Merging block.

Review URL: https://codereview.chromium.org/1415833002

Cr-Commit-Position: refs/heads/master@{#31422}

It is not always safe to allocate new heap objects in the JSGraph. We
might have to revisit this later once we do the canonicalization for
HeapConstants.

R=jarin@chromium.org
BUG=chromium:545364
LOG=n

Review URL: https://codereview.chromium.org/1413373002

Cr-Commit-Position: refs/heads/master@{#31421}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1420543002

Cr-Commit-Position: refs/heads/master@{#31420}

R=jkummerow@chromium.org
BUG=

Committed: https://crrev.com/52225f39df578e77b4804506ca4bc15e096f5cab
Cr-Commit-Position: refs/heads/master@{#31252}

Committed: https://crrev.com/31487015de401892b4d12b5faef0c47c201308da
Cr-Commit-Position: refs/heads/master@{#31305}

Review URL: https://codereview.chromium.org/1396523005

Cr-Commit-Position: refs/heads/master@{#31419}

Skip only for simulator runs.

R=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1418593005

Cr-Commit-Position: refs/heads/master@{#31418}

This reverts commit 24aca870.

The API makes these values appear to be per-isolate, when in fact
they are per-context. Installing the results of these on Template
objects instantiated in multiple contexts can result in security
violations and contexts being retained indefinitely.

An alternative mechanism for using these in a sensible way is
provided by https://crrev.com/1409593002

BUG=
LOG=N
R=jochen@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1415663002

Cr-Commit-Position: refs/heads/master@{#31417}

This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}

The problem is that the gc pattern is different, and the list of debug scripts
may have more or less duplicates than before. The solution is to just turn off
--stress-opt for the test.

R=yangguo@chromium.org
BUG=v8:4502
LOG=N

Review URL: https://codereview.chromium.org/1416883002

Cr-Commit-Position: refs/heads/master@{#31415}

BUG=chromium:534746
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1410333004

Cr-Commit-Position: refs/heads/master@{#31414}

For now, only rewire builtins in v8natives.js to call the new runtime functions.

Review URL: https://codereview.chromium.org/1409613004

Cr-Commit-Position: refs/heads/master@{#31413}

R=bmeurer@chromium.org
TEST=mjsunit/harmony/reflect --exhaustive-variants
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414263002

Cr-Commit-Position: refs/heads/master@{#31412}

Use the simple inline function version of {Min, Max} where possible to
improve performance

Now uses an forced inline js function instead of a python macro
to avoid expressions be evaluated twice

Follow-up to CR: https://codereview.chromium.org/1331993004

Review URL: https://codereview.chromium.org/1410473002

Cr-Commit-Position: refs/heads/master@{#31411}

Review URL: https://codereview.chromium.org/1405363003

Cr-Commit-Position: refs/heads/master@{#31410}

Review URL: https://codereview.chromium.org/1402353006

Cr-Commit-Position: refs/heads/master@{#31409}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1417583003

Cr-Commit-Position: refs/heads/master@{#31408}

TBR=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1416863002 .

Cr-Commit-Position: refs/heads/master@{#31407}

This stages the general purpose inlining mechanism in TurboFan and
also disables the remaining tests that still fail. We do this to get
test coverage early and to avoid regressing inlining as we go along.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419623002

Cr-Commit-Position: refs/heads/master@{#31406}

This fixes JSNativeContextSpecialization to not lower JSLoadGlobal and
JSStoreGlobal nodes if the global variable has morphed into a context
variable that is currently within a TDZ. Scary variable binding is being
scary!

R=bmeurer@chromium.org
TEST=cctest/test-decls/Regress3941 --turbo-filter="f"
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1415733003

Cr-Commit-Position: refs/heads/master@{#31405}

Revert of [es6] Fix scoping for default parameters in arrow functions (patchset #5 id:80001 of https://codereview.chromium.org/1405313002/ )

Reason for revert:
Breaks nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2407/steps/Check/logs/regress-4395

Original issue's description:
> [es6] Fix scoping for default parameters in arrow functions
>
> When eagerly parsing arrow functions, expressions in default
> parameter initializers are parsed in the enclosing scope,
> rather than in the function's scope (since that scope does not
> yet exist). This leads to VariableProxies being added to the
> wrong scope, and scope chains for FunctionLiterals being incorrect.
>
> This patch addresses these problems by adding a subclass of
> AstExpressionVisitor that moves VariableProxies to the proper
> scope and fixes up scope chains of FunctionLiterals.
>
> More work likely still needs to be done to make this work completely,
> but it's very close to correct.
>
> BUG=v8:4395
> LOG=y
>
> Committed: https://crrev.com/cf72aad39e51de9b7074ea039377c1812f4a2c6b
> Cr-Commit-Position: refs/heads/master@{#31402}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4395

Review URL: https://codereview.chromium.org/1417463004

Cr-Commit-Position: refs/heads/master@{#31404}

This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}

When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1405313002

Cr-Commit-Position: refs/heads/master@{#31402}

We need to use the ReturnId for calls, otherwise lazy bailout will not
work correctly in case of inlining.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407953004

Cr-Commit-Position: refs/heads/master@{#31401}

BUG=chromium:544774
LOG=n

Review URL: https://codereview.chromium.org/1409023004

Cr-Commit-Position: refs/heads/master@{#31400}

This fixes the bailout point used by JSCreateScriptContext nodes for
top-level code. The bailout point differs from the Crankshaft one as
parameter slots have not been copied and the context chain was not
extended yet in TurboFan. Hence a new bailout id is required.

R=ishell@chromium.org
TEST=cctest/test-decls/CrossScript --turbo-inlining

Review URL: https://codereview.chromium.org/1413933005

Cr-Commit-Position: refs/heads/master@{#31399}