port 29ebcc32 (r30496).

original commit message:

    This CL introduces HPrologue instruction which does the context allocation work and supports deoptimization.

BUG=

Review URL: https://codereview.chromium.org/1308743005

Cr-Commit-Position: refs/heads/master@{#30606}

port fbad6366 (r30467)

original commit message:

    The call protocol requires that the register dedicated to the number of
    actual arguments (i.e. rax on x64) always contains the actual arguments.
    That means after adapting arguments it should match the number of
    expected arguments.  But currently we pass some semi-random value
    (usually some stack address) after adapting arguments.

    It looks like this is currently not observable anywhere, because our
    builtins and functions either don't look at the number of arguments and
    just make hard coded (unchecked) assumptions, or are marked as "don't
    adapt arguments", which bypasses the broken code in the trampoline for
    arguments adaption.  Nevertheless this should be fixed.

BUG=

Review URL: https://codereview.chromium.org/1304893010

Cr-Commit-Position: refs/heads/master@{#30605}

Additionally, improve immediate operand matching for branches
to avoid duplicated constant loading.

Review URL: https://codereview.chromium.org/1326173002

Cr-Commit-Position: refs/heads/master@{#30604}

BUG=

Review URL: https://codereview.chromium.org/1322693004

Cr-Commit-Position: refs/heads/master@{#30603}

[arm] Decrease the size of the assembler class by allocating buffers of pending constants on the heap.

BUG=chromium:521828
LOG=N

Review URL: https://codereview.chromium.org/1310863005

Cr-Commit-Position: refs/heads/master@{#30602}

Rolling v8/build/gyp to 2b17e0b26a93e8c9758c23aec6c554da4ca8f0a9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1324213006

Cr-Commit-Position: refs/heads/master@{#30601}

Wasm mjsunit tests aren't being detected when symlinked into
test/mjsunit/wasm. This causes symlinked directories in that
directory to be included.

BUG=None
TEST=local
R=dehrenberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1332463002

Cr-Commit-Position: refs/heads/master@{#30600}

Much faster and constant than always searching the whole string

````
var allCodePoints = [];
for (var i = 0; i < 65536; i++) allCodePoints[i] = i;
var allCharsString = String.fromCharCode.apply(String, allCodePoints);

function bench(search) {
  var counter = 0;
  print(search + " found at " + allCharsString.startsWith(search));
  var start = Date.now();
  while (counter++ < 5000000) {
    allCharsString.startsWith(search);
  }
  var end = Date.now();
  print(end - start);
  return counter;
}

print("single character");
bench("\u0000");
bench("\u0050");
bench("\u1000");
````

OLD

single character
 found at true
374
P found at false
559
က found at false
13492

NEW

single character
 found at true
261
P found at false
146
က found at false
146

BUG=v8:4384
LOG=N

Review URL: https://codereview.chromium.org/1321853006

Cr-Commit-Position: refs/heads/master@{#30599}

BUG= https://github.com/WebAssembly/v8-native-prototype/issues/10
TEST=manual check of wasm=on
R=dehrenberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1306753007

Cr-Commit-Position: refs/heads/master@{#30598}

Uses the lower byte with memchr which is
significantly faster than a naive compare

Performance difference with bench (http://hastebin.com/xuxexataso.js):

old                             new

single character                single character
Κ found at 922                  Κ found at 922
3324                            616
㎡ found at 13217               ㎡ found at 13217
42366                           4931
က found at 4096                 က found at 4096
13369                           9836
＀ found at 65280                ＀ found at 65280
207472                          36149
ﾥ found at 65445                ﾥ found at 65445
209344                          36666
  found at 8197                   found at 8197
26731                           11757
倂 found at 20482               倂 found at 20482
66071                           17193

linear search                   linear search
ΚΛ found at 922                 ΚΛ found at 922
4112                            504
㎡㎢ found at 13217             ㎡㎢ found at 13217
55105                           5119
ﾥﾦ found at 65445               ﾥﾦ found at 65445
268016                          35496

linear + bmh search             linear + bmh search
ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
2897                            522
ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445         ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445
167687                          35283

BUG=

Review URL: https://codereview.chromium.org/1324453007

Cr-Commit-Position: refs/heads/master@{#30597}

The patch decreases the calls of huge switch instructions making the DecodeType*() functions to work in one phase and optimizing Instruction::InstructionType(). Speed gain in release full check is about 33% (6:13 s -> 4:09 s) and in optdebug full test is about 50% (12:29 -> 6:17)

BUG=

Review URL: https://codereview.chromium.org/1310883005

Cr-Commit-Position: refs/heads/master@{#30596}

BUG=chromium:527345, chromium:522289
LOG=N

Review URL: https://codereview.chromium.org/1323243005

Cr-Commit-Position: refs/heads/master@{#30595}

Bookmarks may create a race condition which
results in syntax errors. The more files are parsed
in parallel the higher the probability that the error
occurs.
Unfortunately it is not possible to simply revert the
CLs related to Bookmarks.

BUG=chromium:527930,chromium:510825
LOG=Y

Review URL: https://codereview.chromium.org/1315173007

Cr-Commit-Position: refs/heads/master@{#30594}

Revert of [arm] Decrease the size of the assembler class by allocating buffers of pending constants on the he… (patchset #2 id:20001 of https://codereview.chromium.org/1309903009/ )

Reason for revert:
Static assert failed on ARM64

Original issue's description:
> [arm] Decrease the size of the assembler class by allocating buffers of pending constants on the heap.
>
> BUG=chromium:521828
> LOG=N
>
> Committed: https://crrev.com/033af3fa511c52bc4049cd278d0623a6c6f9f9c3
> Cr-Commit-Position: refs/heads/master@{#30592}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:521828

Review URL: https://codereview.chromium.org/1307863007

Cr-Commit-Position: refs/heads/master@{#30593}

[arm] Decrease the size of the assembler class by allocating buffers of pending constants on the heap.

BUG=chromium:521828
LOG=N

Review URL: https://codereview.chromium.org/1309903009

Cr-Commit-Position: refs/heads/master@{#30592}

The original intention of this seemed to have been to enable DEBUG when
NDEBUG was not defined within Google3. Everything since then was just
added to avoid the "#error" below checking for consistency from firing.
Semantics have also shifted along the way. I vote for dropping this.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1315063007

Cr-Commit-Position: refs/heads/master@{#30591}

Port 64e3bad3

Original commit message:
    This is uncontroversial the dead code removal part of
    https://codereview.chromium.org/1307943013, which was
    previously landed, but got reverted because of DOM
    breakage that requires more investigation.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1311123004

Cr-Commit-Position: refs/heads/master@{#30590}

BUG=

Review URL: https://codereview.chromium.org/1324153003

Cr-Commit-Position: refs/heads/master@{#30589}

Revert of Speedup stringsearch for two byte strings (patchset #3 id:40001 of https://codereview.chromium.org/1303033012/ )

Reason for revert:
[Sheriff] Breaks fuzzer and msan:
http://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/4773

Repro with:
tools/fuzz-harness.sh out/Debug/d8
(in a ninja Debug build)

Msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/4097

Original issue's description:
> Speedup stringsearch for two byte strings
>
> Uses the lower byte with memchr which is
> significantly faster than a naive compare
>
> Performance difference with bench (http://hastebin.com/xuxexataso.js):
>
> old                             new
>
> single character                single character
> Κ found at 922                  Κ found at 922
> 3324                            616
> ㎡ found at 13217               ㎡ found at 13217
> 42366                           4931
> က found at 4096                 က found at 4096
> 13369                           9836
> ＀ found at 65280                ＀ found at 65280
> 207472                          36149
> ﾥ found at 65445                ﾥ found at 65445
> 209344                          36666
>   found at 8197                   found at 8197
> 26731                           11757
> 倂 found at 20482               倂 found at 20482
> 66071                           17193
>
> linear search                   linear search
> ΚΛ found at 922                 ΚΛ found at 922
> 4112                            504
> ㎡㎢ found at 13217             ㎡㎢ found at 13217
> 55105                           5119
> ﾥﾦ found at 65445               ﾥﾦ found at 65445
> 268016                          35496
>
> linear + bmh search             linear + bmh search
> ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
> 2897                            522
> ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445         ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445
> 167687                          158465
>
> Committed: https://crrev.com/fced280f37588f8a232a414201276e053117e9ea
> Cr-Commit-Position: refs/heads/master@{#30587}

TBR=danno@chromium.org,mstarzinger@chromium.org,jkummerow@chromium.org,karl@skomski.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1331433002

Cr-Commit-Position: refs/heads/master@{#30588}

Uses the lower byte with memchr which is
significantly faster than a naive compare

Performance difference with bench (http://hastebin.com/xuxexataso.js):

old                             new

single character                single character
Κ found at 922                  Κ found at 922
3324                            616
㎡ found at 13217               ㎡ found at 13217
42366                           4931
က found at 4096                 က found at 4096
13369                           9836
＀ found at 65280                ＀ found at 65280
207472                          36149
ﾥ found at 65445                ﾥ found at 65445
209344                          36666
  found at 8197                   found at 8197
26731                           11757
倂 found at 20482               倂 found at 20482
66071                           17193

linear search                   linear search
ΚΛ found at 922                 ΚΛ found at 922
4112                            504
㎡㎢ found at 13217             ㎡㎢ found at 13217
55105                           5119
ﾥﾦ found at 65445               ﾥﾦ found at 65445
268016                          35496

linear + bmh search             linear + bmh search
ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
2897                            522
ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445         ﾥﾦﾧﾨﾩﾪﾫﾬ found at 65445
167687                          158465

Review URL: https://codereview.chromium.org/1303033012

Cr-Commit-Position: refs/heads/master@{#30587}

JS_ITERATOR_RESULT_TYPE was missing but required (repro: load inbox.google.com with a Debug build).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1302313013

Cr-Commit-Position: refs/heads/master@{#30586}

Review URL: https://codereview.chromium.org/1311123005

Cr-Commit-Position: refs/heads/master@{#30585}

BUG=

Review URL: https://codereview.chromium.org/1314703005

Cr-Commit-Position: refs/heads/master@{#30584}

BUG=chromium:515782
LOG=n

Review URL: https://codereview.chromium.org/1321943004

Cr-Commit-Position: refs/heads/master@{#30583}

Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
and %HasProperty anyway, and cannot be optimized, plus it had a weird
special fast case (which also involved at least one LOAD_IC plus some
intrinsic magic).

R=yangguo@chromium.org,jarin@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel

Committed: https://crrev.com/72d60a1e80e81e2e68ca402665e2acbc46c5e471
Cr-Commit-Position: refs/heads/master@{#30154}

Review URL: https://codereview.chromium.org/1295433002

Cr-Commit-Position: refs/heads/master@{#30582}

The last changes for vector store functionality, they are in 3 areas:

1) The new vector [keyed] store code stubs - implementation.
2) IC and handler compiler adjustments
3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.

TBR=bmeurer@chromium.org, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1319123004

Cr-Commit-Position: refs/heads/master@{#30581}

If the range doesn't have calls, but still fails to allocate, try and find a split
position outside a loop.

BUG=

Review URL: https://codereview.chromium.org/1301393012

Cr-Commit-Position: refs/heads/master@{#30580}

Once  a range is found to have a conflict, split around all the calls it
crosses over, since it will anyway have conflicts there, too.

Incrementally, from the last change to greedy, this change brings
overall improvement in benchmarks. In fact, except for 2 regressions
in Jetstream (splay-latency and date-format-xparb, at 6 and 7%
respectivelly), everything else is in the green or noise. Quite a few
benchmarks are over 3%, with a few (zlib, for example) in the double
digits.

Review URL: https://codereview.chromium.org/1328783002

Cr-Commit-Position: refs/heads/master@{#30579}

Rolling v8/build/gyp to 2b17e0b26a93e8c9758c23aec6c554da4ca8f0a9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1305273008

Cr-Commit-Position: refs/heads/master@{#30578}

This is uncontroversial the dead code removal part of
https://codereview.chromium.org/1307943013, which was
previously landed, but got reverted because of DOM
breakage that requires more investigation.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1322843005

Cr-Commit-Position: refs/heads/master@{#30577}

Port 8a378f46

Original commit message:
    This turns the has_instance_call_handler bit on Map into an is_callable
    bit, that matches the spec definition of IsCallable (i.e. instances have
    [[Call]] internal methods).

    Also fix the typeof operator to properly say "function" for everything
    that is callable.

    Also remove the (unused) premature %_GetPrototype optimization from
    Crankshaft, which just complicated the Map bit swap.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1330613005

Cr-Commit-Position: refs/heads/master@{#30576}

Port 72bc4b5c

Original commit message:
    Use a single JSIteratorResult type for all implementation provided
    iterator results (i.e. the String, Array and collection iterators,
    and also for generators).  This removes one source of unnecessary
    polymorphism in for-of loops.  It is accomplished by a new intrinsic
    %_CreateIterResultObject() that should be used to create iterator
    result objects from JavaScript builtins (there's a matching factory
    method for C++ code).

    Also restructure the %StringIteratorPrototype%.next() and
    %ArrayIteratorPrototype%.next() functions to be a bit more friendly
    to optimizing compilers.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1325203004

Cr-Commit-Position: refs/heads/master@{#30575}

Port 510baeac

Original commit message:
    Kills the kRestParameter bailout/disabled optimization, and fixes
    lazily parsed arrow functions with rest parameters.

    Supercedes https://crrev.com/1235153006/

R=caitpotter88@gmail.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:508074, v8:2160, v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1318523006

Cr-Commit-Position: refs/heads/master@{#30574}

 - Print the summary excluding other tick information
 - Add test to verify that summary is printed correctly.

BUG=None
LOG=N

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1318933004

Cr-Commit-Position: refs/heads/master@{#30573}

Port 72bc4b5c

Original commit message:
Use a single JSIteratorResult type for all implementation provided
iterator results (i.e. the String, Array and collection iterators,
and also for generators).  This removes one source of unnecessary
polymorphism in for-of loops.  It is accomplished by a new intrinsic
%_CreateIterResultObject() that should be used to create iterator
result objects from JavaScript builtins (there's a matching factory
method for C++ code).

Also restructure the %StringIteratorPrototype%.next() and
%ArrayIteratorPrototype%.next() functions to be a bit more friendly
to optimizing compilers.

BUG=

Review URL: https://codereview.chromium.org/1315903005

Cr-Commit-Position: refs/heads/master@{#30572}

Revert of Vector ICs: platform support for vector-based stores. (patchset #7 id:120001 of https://codereview.chromium.org/1328603003/ )

Reason for revert:
[Sheriff] Breaks compile on arm:
http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20builder/builds/6590

Original issue's description:
> Vector ICs: platform support for vector-based stores.
>
> The last changes for vector store functionality, they are in 3 areas:
>
> 1) The new vector [keyed] store code stubs - implementation.
> 2) IC and handler compiler adjustments
> 3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.
>
> BUG=
>
> Committed: https://crrev.com/63af1b3aec6547e7cdf502666ff79c562de8b679
> Cr-Commit-Position: refs/heads/master@{#30570}

TBR=bmeurer@chromium.org,jkummerow@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1303053004

Cr-Commit-Position: refs/heads/master@{#30571}

The last changes for vector store functionality, they are in 3 areas:

1) The new vector [keyed] store code stubs - implementation.
2) IC and handler compiler adjustments
3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.

BUG=

Review URL: https://codereview.chromium.org/1328603003

Cr-Commit-Position: refs/heads/master@{#30570}

This reverts commit b06a6a89.

BUG=chromium:519319,chromium:515873
LOG=NO

Review URL: https://codereview.chromium.org/1311993003

Cr-Commit-Position: refs/heads/master@{#30569}

Revert of [es5] Class of object is "Function" if object has [[Call]]. (patchset #3 id:40001 of https://codereview.chromium.org/1307943013/ )

Reason for revert:
[Sheriff] Changes several layout test expectations. Please fix upstream first if intended. E.g.:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/1729

Several lines change from PASS to FAIL.

Original issue's description:
> [es5] Class of object is "Function" if object has [[Call]].
>
> The concept of class was mostly removed from ES6, but we still use the
> class of objects to distinguish object kinds in our builtins.  So update
> this to be in sync with IsCallable (thereby getting rid of the previous
> instance type based tests for callable things completely).
>
> R=jarin@chromium.org, jkummerow@chromium.org
>
> Committed: https://crrev.com/af778389947f1b01fb036756ea3cb8ed8ab98452
> Cr-Commit-Position: refs/heads/master@{#30566}

TBR=jarin@chromium.org,jkummerow@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1306303005

Cr-Commit-Position: refs/heads/master@{#30568}

This relands https://codereview.chromium.org/1303183005

BUG=chromium:515782
LOG=n
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1330623002

Cr-Commit-Position: refs/heads/master@{#30567}