Adds interpreter entry and exit trampoline builtins. Also implements the
Return bytecode handler and fixes a few bugs in InterpreterAssembler
highlighted by running on other architectures.

MIPS and MIPS64 port contributed by Paul Lind (paul.lind@imgtec.com)

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1245133002

Cr-Commit-Position: refs/heads/master@{#29929}

All runtime function get a context anyway, which is the same as the
explicit one in case of DeclareGlobals and DeclareLookupSlot. So
we can remove the additional parameter there.

As an additional bonus, improve the runtime interface to DeclareLookupSlot.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1261863002

Cr-Commit-Position: refs/heads/master@{#29923}

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

BUG=v8:3996
R=bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1262583002

Cr-Commit-Position: refs/heads/master@{#29893}

No need to pass the name explicitly to the stubs; the runtime can
extract the name from the ScopeInfo (the extension of the
ScriptContext) on-demand easily without any performance impact.

Review URL: https://codereview.chromium.org/1259963002

Cr-Commit-Position: refs/heads/master@{#29886}

Revert of Remove ExternalArray, derived types, and element kinds (patchset #5 id:80001 of https://codereview.chromium.org/1254623002/)

Reason for revert:
[Sheriff] Breaks several layout tests, e.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/1067

Several output lines change from PASS to FAIL. If the changes are intended, please land a needsmanualrebaseline change in blink first.

Original issue's description:
> Remove ExternalArray, derived types, and element kinds
>
> BUG=v8:3996
> R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
> LOG=y
>
> Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c
> Cr-Commit-Position: refs/heads/master@{#29872}

TBR=bmeurer@chromium.org,hpayer@chromium.org,jarin@chromium.org,mvstanton@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1257223002

Cr-Commit-Position: refs/heads/master@{#29883}

We don't need the hole check and slow runtime mode for read-only
properties this way.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1255133002

Cr-Commit-Position: refs/heads/master@{#29881}

BUG=v8:3996
R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1254623002

Cr-Commit-Position: refs/heads/master@{#29872}

Review URL: https://codereview.chromium.org/1259853002

Cr-Commit-Position: refs/heads/master@{#29860}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1248443003

Cr-Commit-Position: refs/heads/master@{#29840}

This is the initial round of optimizations for the
LoadGlobalViaContextStub and StoreGlobalViaContextStub, basically
turning them into platform code stubs to avoid the Crankshaft overhead
in the fast case, and making the runtime interface cheaper.

R=ishell@chromium.org
BUG=chromium:510694
LOG=n

Review URL: https://codereview.chromium.org/1238143002

Cr-Commit-Position: refs/heads/master@{#29834}

Review URL: https://codereview.chromium.org/1251593009

Cr-Commit-Position: refs/heads/master@{#29825}

All of this is controlled by the CallDescriptor. It's simply the case
that if you specify less registers than the function arity calls for,
the rest are assumed to be on the stack.

Bailout handlers accept these constant stack arguments too.

BUG=

Review URL: https://codereview.chromium.org/1250563004

Cr-Commit-Position: refs/heads/master@{#29813}

Previous to this CL, ICs used a slightly different code idiom
to get to C++ code from generated code than runtime intrinsics,
using an IC_Utility class that in essence provided exactly
the same functionality as Runtime::FunctionForId, but in its
own quirky way.

This CL unifies the two mechanisms, folding IC_Utility
away by making all IC entry points in C++ code, e.g. IC
miss handlers, full-fledged runtime intrinsics. This makes
it possible to eliminate a bunch of ad-hoc declarations and
adapters that the IC system had to needlessly re-invent.

As a bonus and the original reason for this yak-shave:
IC-related C++ runtime functions are now callable from
TurboFan.

Review URL: https://codereview.chromium.org/1248303002

Cr-Commit-Position: refs/heads/master@{#29811}

R=mvstanton@chromium.org

Committed: https://crrev.com/937d4efbf9c399339fdc8e041bec8e80baa7b58f
Cr-Commit-Position: refs/heads/master@{#29798}

Review URL: https://codereview.chromium.org/1255613002

Cr-Commit-Position: refs/heads/master@{#29805}

Revert of Reduce duplicate code in full-codegen across platforms. (patchset #1 id:1 of https://codereview.chromium.org/1255613002/)

Reason for revert:
breaks mips

Original issue's description:
> Reduce duplicate code in full-codegen across platforms.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/937d4efbf9c399339fdc8e041bec8e80baa7b58f
> Cr-Commit-Position: refs/heads/master@{#29798}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1252513004

Cr-Commit-Position: refs/heads/master@{#29802}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1255613002

Cr-Commit-Position: refs/heads/master@{#29798}

It's just the same as StoreTransitionDescriptor.

BUG=

Review URL: https://codereview.chromium.org/1248973002

Cr-Commit-Position: refs/heads/master@{#29789}

This fixes a recent regression where the register holding the original
receiver was pushed onto the stack before the internal frame within the
CallStubInRecordCallTarget helper was created. That in turn confused
the stack walker when allocations in these stubs failed.

R=mvstanton@chromium.org
BUG=chromium:512711
LOG=N

Review URL: https://codereview.chromium.org/1245043003

Cr-Commit-Position: refs/heads/master@{#29787}

The layout of fixed typed array base is then capable of handling
external typed arrays as well. In a follow-up CL, I'll delete external
typed arrays, and use fixed typed array base instead

BUG=v8:3996
R=jarin@chromium.org,mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1248483007

Cr-Commit-Position: refs/heads/master@{#29786}

This will be used to compute the base pointer of the new unified
representation for both on-heap and external typed arrays. The idea is
that either the external or the tagged pointer is 0 (although in
practice, if the tagged pointer is non-0, the external pointer will
contain the offset from the start of the on-heap typed array to the data
in the on-heap typed array).

The HAdd is marked as depending on new-space promotion, as the tagged
pointer might move during GC, and so the result of the addition needs to
be recomputed.

BUG=v8:3996
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1244693002

Cr-Commit-Position: refs/heads/master@{#29760}

Prior to this patch, we enter a global debug mode whenever a break point
is set. By entering this mode, all code is deoptimized and activated
frames are recompiled and redirected to newly compiled debug code.

After this patch, we only deoptimize/redirect for functions we want to
debug. Trigger for this is Debug::EnsureDebugInfo, and having DebugInfo
object attached to the SFI prevents optimization/inlining.

The result is that we can have optimized code for functions without break
points alongside functions that do have break points, which are not
optimized.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=v8:4132
LOG=Y

Review URL: https://codereview.chromium.org/1233073005

Cr-Commit-Position: refs/heads/master@{#29758}

This adds the implicit function variable for a function literal to the
declarations list in scope analysis, instead of specially handling it
throughout all back-ends.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1245603003

Cr-Commit-Position: refs/heads/master@{#29754}

BUG=chromium:510738
LOG=N

Review URL: https://codereview.chromium.org/1228113008

Cr-Commit-Position: refs/heads/master@{#29743}

Additionally, push the allocation site or undefined independently of creating a memento to preserve a fixed size for the construct frames.

BUG=

Review URL: https://codereview.chromium.org/1239593003

Cr-Commit-Position: refs/heads/master@{#29719}

This CL exposes the constructor function, defines type related
information, and implements value type semantics.
It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.

TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc

LOG=Y
BUG=v8:4124

Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
Cr-Commit-Position: refs/heads/master@{#29689}

Review URL: https://codereview.chromium.org/1219943002

Cr-Commit-Position: refs/heads/master@{#29712}

The aforementioned intrinsic is no longer needed and can be fully
desugared now that binding assignments to 'this' are explicit.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1234383002

Cr-Commit-Position: refs/heads/master@{#29706}

This makes the implicit initializing assignment to 'this' performed
after a super constructor call explicit in the AST. It removes the
need to handle the special case where a CallExpression behaves like a
AssignmentExpression from various AstVisitor implementations.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1226123010

Cr-Commit-Position: refs/heads/master@{#29705}

Revert of Expose SIMD.Float32x4 type to Javascript. (patchset #14 id:450001 of https://codereview.chromium.org/1219943002/)

Reason for revert:
Seems to brake the latest roll into Chromium: http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_compile_dbg_ng/builds/59796/steps/compile%20%28with%20patch%29/logs/stdio

Original issue's description:
> Expose SIMD.Float32x4 type to Javascript.
> This CL exposes the constructor function, defines type related
> information, and implements value type semantics.
> It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.
>
> TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc
>
> LOG=Y
> BUG=v8:4124
>
> Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
> Cr-Commit-Position: refs/heads/master@{#29689}

TBR=rossberg@chromium.org,littledan@chromium.org,martyn.capewell@arm.com,bbudge@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review URL: https://codereview.chromium.org/1241533004

Cr-Commit-Position: refs/heads/master@{#29701}

This CL exposes the constructor function, defines type related
information, and implements value type semantics.
It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.

TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1219943002

Cr-Commit-Position: refs/heads/master@{#29689}

This changes the calling convention of the CallConstructStub to take
the original constructor (i.e. new.target in JS-speak) in a register
instead of magically via the operand stack. For optimizing compilers
the operand stack doesn't exist, hence cannot be peeked into.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1237813002

Cr-Commit-Position: refs/heads/master@{#29681}

By not having to patch the return sequence (we patch the debug
break slot right before it), we don't overwrite it and therefore
don't have to keep the original copy of the code around.

R=ulan@chromium.org
BUG=v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1234833003

Cr-Commit-Position: refs/heads/master@{#29672}

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1235983002

Cr-Commit-Position: refs/heads/master@{#29646}

The new implemtation counts the number of calls (or continuations)
before the PC to find the corresponding PC in the new code.

R=mstarzinger@chromium.org
BUG=chromium:507070
LOG=N

Review URL: https://codereview.chromium.org/1235603002

Cr-Commit-Position: refs/heads/master@{#29636}

BUG=v8:4296
LOG=n

Review URL: https://codereview.chromium.org/1228063004

Cr-Commit-Position: refs/heads/master@{#29618}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1227163011

Cr-Commit-Position: refs/heads/master@{#29617}

NON_CONTEXTUAL ~> INSIDE_TYPEOF
CONTEXTUAL ~> NOT_INSIDE_TYPEOF

Review URL: https://codereview.chromium.org/1227893005

Cr-Commit-Position: refs/heads/master@{#29611}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1235893002

Cr-Commit-Position: refs/heads/master@{#29607}

- split relocation info for debug break slots for
  - calls (with call arguments count as data)
  - construct calls
  - normal slots
- renamed DEBUG_BREAK into DEBUGGER_STATEMENT
- removed unused IC state for Debug stubs

R=ulan@chromium.org
BUG=v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1232803002

Cr-Commit-Position: refs/heads/master@{#29603}

Loads and stores to global vars are now made via property cell shortcuts installed into parent script context.

This CL also adds hydrogen stubs for global loads and global stores, full-codegen and TurboFan now uses this machinery.

Review URL: https://codereview.chromium.org/1224793002

Cr-Commit-Position: refs/heads/master@{#29592}

Note that there are currently no objects that require a pre-allocated
properties backing store, all such slots are in-object properties from
the begining. Hence {unused + pre_allocated - inobject == 0} holds.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1226203011

Cr-Commit-Position: refs/heads/master@{#29590}