They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

BUG=

Review URL: https://codereview.chromium.org/1067573003

Cr-Commit-Position: refs/heads/master@{#27788}

BUG=

Review URL: https://codereview.chromium.org/1085623002

Cr-Commit-Position: refs/heads/master@{#27787}

R=jochen@chromium.org, hpayer@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1064713005

Cr-Commit-Position: refs/heads/master@{#27786}

rename to ReferenceMap
use ZoneVector for storage
drop dead code

BUG=

Review URL: https://codereview.chromium.org/1081053002

Cr-Commit-Position: refs/heads/master@{#27785}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1082703003

Cr-Commit-Position: refs/heads/master@{#27784}

BUG=

Review URL: https://codereview.chromium.org/1081803002

Cr-Commit-Position: refs/heads/master@{#27783}

This allows the embedder to decide whether it's worthwhile to copy the
contents to avoid materializing a buffer.

BUG=v8:3996
R=dslomov@chromium.org,kbr@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1084513002

Cr-Commit-Position: refs/heads/master@{#27782}

Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}

This is a follow-up to https://codereview.chromium.org/1078093002.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1083623002

Cr-Commit-Position: refs/heads/master@{#27780}

BUG=v8:4023
LOG=NO

Review URL: https://codereview.chromium.org/1081033004

Cr-Commit-Position: refs/heads/master@{#27779}

port 4bd9bdbb (r27751)

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1051323003

Cr-Commit-Position: refs/heads/master@{#27778}

port 74c38122 (r27714)

original commit message:

  [es6] implement spread calls

BUG=

Review URL: https://codereview.chromium.org/1085533002

Cr-Commit-Position: refs/heads/master@{#27777}

TBR=mstarzinger@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1079943003

Cr-Commit-Position: refs/heads/master@{#27776}

This makes the compilers agree on the source position of a message
generated by "throw new Error()", it points to the beginning of the
throw directive.

R=titzer@chromium.org
TEST=message/regress/regress-3995
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1049703002

Cr-Commit-Position: refs/heads/master@{#27775}

This tweak was already present in CrankShaft for the non-AVX case. As it
turns out, it's also relevant even with AVX. Now the same optimization
is applied in case of TurboFan as well.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1081033003

Cr-Commit-Position: refs/heads/master@{#27774}

This commit is a precursor to making lazy arrow function parsing use
similar logic to function(){} argument parsing.

R=arv@chromium.org
BUG=4020
LOG=N

Review URL: https://codereview.chromium.org/1078093002

Cr-Commit-Position: refs/heads/master@{#27773}

Rolling v8/tools/clang to 76fad2f3eb2d3d649bcca82e5ece02d09969e528

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1086453002

Cr-Commit-Position: refs/heads/master@{#27772}

BUG=

Review URL: https://codereview.chromium.org/1077413002

Cr-Commit-Position: refs/heads/master@{#27771}

The ES6 specification does not explicitly state the attributes for the
'next' and 'throw' property descriptors, so their values are defined by
Section 17 [1]:

> Every other data property described in clauses 18 through 26 and in
> Annex B.2 has the attributes
> { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
> unless otherwise specified.

[1]
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-ecmascript-standard-built-in-objects

BUG=v8:3986
LOG=N
R=wingo,arv

Review URL: https://codereview.chromium.org/1051363003

Cr-Commit-Position: refs/heads/master@{#27770}

Reason for revert:
Test failures in string-index and regress-1187524.

This reverts commit b45a664f.

BUG=

Review URL: https://codereview.chromium.org/1050943004

Cr-Commit-Position: refs/heads/master@{#27769}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1072343002

Cr-Commit-Position: refs/heads/master@{#27768}

BUG=v8:3502
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1072573002

Cr-Commit-Position: refs/heads/master@{#27767}

When debugging Handle leaks in io.js we found it very convenient to be
able to Seal some specific (root in our case) scope to prevent Handle
allocations in it, and easily find leakage.

R=yangguo
BUG=

Review URL: https://codereview.chromium.org/1079713002

Cr-Commit-Position: refs/heads/master@{#27766}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1078353002

Cr-Commit-Position: refs/heads/master@{#27765}

Fix c67cb287

Cannot access kStartIndex and kDirectCall parameters as ints on 64-bit BE platforms.

R=yangguo@chromium.org, mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1074203003

Cr-Commit-Position: refs/heads/master@{#27764}

Port 74c38122

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078253004

Cr-Commit-Position: refs/heads/master@{#27763}

Port 725cdc53

Original commit message:
This reduces the overhead of recursive calls when context specialization
is enabled. Based on this it might be possible to further reduce the
overhead by also specializing the call itself.

As a drive-by-fix, port the fast context materialization optimization to
arm and arm64, that was previously only supported on x64 and ia32.

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078183002

Cr-Commit-Position: refs/heads/master@{#27762}

Port 4e7163ce

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1076263002

Cr-Commit-Position: refs/heads/master@{#27761}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1065863003

Cr-Commit-Position: refs/heads/master@{#27760}

Few pieces leftover which are now effectively dead code and can be safely
deleted.

BUG=v8:3502
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1052963004

Cr-Commit-Position: refs/heads/master@{#27759}

BUG=v8:3018
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1079103005

Cr-Commit-Position: refs/heads/master@{#27758}

Port 35a67b74

Original commit message:
Thanks to some careful assumptions, we can examine the object found at
vector[slot] and trust it's a heap object where the second field is
either a map if it's a WeakCell, or definitely not a map if it's a
Symbol, String or FixedArray. Use this to save a memory read.

BUG=

Review URL: https://codereview.chromium.org/1053843003

Cr-Commit-Position: refs/heads/master@{#27757}

Implements the strong mode proposal's static restrictions on the use of the
identifier 'undefined', for arrow functions. Assumes these restrictions are
intended to be identical to the restrictions on the use of 'eval and 'arguments'
in strict mode. In addition, Location variables inconsistantly named (e.g.
dupe_error_loc vs dupe_loc) are now consistently named the shorter way.

Baseline: https://codereview.chromium.org/1070633002

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1060883004

Cr-Commit-Position: refs/heads/master@{#27756}

Revert of Make full GC reduce memory footprint an explicit event in the idle notification handler. (patchset #2 id:20001 of https://codereview.chromium.org/1072363002/)

Reason for revert:
[Sheriff] breaks nosnap with timeouts:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/2513
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6220

Original issue's description:
> Make full GC reduce memory footprint an explicit event in the idle notification handler.
>
> BUG=
>
> Committed: https://crrev.com/845705aa99b6bfa8d264cfda1c3b5f1229802ab5
> Cr-Commit-Position: refs/heads/master@{#27753}

TBR=ulan@chromium.org,rmcilroy@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1081443002

Cr-Commit-Position: refs/heads/master@{#27755}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1074143002

Cr-Commit-Position: refs/heads/master@{#27754}

BUG=

Review URL: https://codereview.chromium.org/1072363002

Cr-Commit-Position: refs/heads/master@{#27753}

R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1072333002

Cr-Commit-Position: refs/heads/master@{#27752}

This fixes the arm(64) and mips(64) write barriers

BUG=

Review URL: https://codereview.chromium.org/1073133002

Cr-Commit-Position: refs/heads/master@{#27751}

BUG=

Review URL: https://codereview.chromium.org/1074153002

Cr-Commit-Position: refs/heads/master@{#27750}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1074133002

Cr-Commit-Position: refs/heads/master@{#27749}