Does not entirely disallow the use of 'eval' as an identifier in strong mode,
as originally proposed.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1059273004

Cr-Commit-Position: refs/heads/master@{#27796}

BUG=chromium:388665
LOG=n

Review URL: https://codereview.chromium.org/1087463003

Cr-Commit-Position: refs/heads/master@{#27795}

Use fsub rather than fadd to avoid stripping the sign from minus zero.

Fixes mjsunit/result-table-min and mjsunit/result-table-max test failures.

R=michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1084583003

Cr-Commit-Position: refs/heads/master@{#27794}

These options were added for a hydrogen code stub version of
the VectorIC dispatcher, which was discontinued.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1081883002

Cr-Commit-Position: refs/heads/master@{#27793}

R=mstarzinger@chromium.org,verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1077343002

Cr-Commit-Position: refs/heads/master@{#27792}

This reverts commit e965a1f8.

The reason is that it breaks jsfiddle.com

BUG=476437, v8:4001
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1086673002

Cr-Commit-Position: refs/heads/master@{#27791}

Revert of VectorICs: megamorphic keyed loads in crankshaft don't need a vector. (patchset #3 id:40001 of https://codereview.chromium.org/1067573003/)

Reason for revert:
[Sheriff] Speculative revert for windows failure... will reland if it doesn't help:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug%20-%202/builds/2891

Original issue's description:
> VectorICs: megamorphic keyed loads in crankshaft don't need a vector.
>
> They are content with a dummy vector, as MISSES won't result in
> changing the real vector/slot at all.
>
> BUG=
>
> Committed: https://crrev.com/c8e4d57d3b3036a05902f5b916cb5d853a57393c
> Cr-Commit-Position: refs/heads/master@{#27788}

TBR=dcarney@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1060263003

Cr-Commit-Position: refs/heads/master@{#27790}

Revert of Wrap typed array implementations in functions. (patchset #1 id:1 of https://codereview.chromium.org/1082703003/)

Reason for revert:
[Sheriff] Flaky nosnap failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%201/builds/1720
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3312
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3313

Original issue's description:
> Wrap typed array implementations in functions.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/6fc394a15614b74776f9bbeeb0486f430bdc8597
> Cr-Commit-Position: refs/heads/master@{#27784}

TBR=mvstanton@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1086683002

Cr-Commit-Position: refs/heads/master@{#27789}

They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

BUG=

Review URL: https://codereview.chromium.org/1067573003

Cr-Commit-Position: refs/heads/master@{#27788}

BUG=

Review URL: https://codereview.chromium.org/1085623002

Cr-Commit-Position: refs/heads/master@{#27787}

R=jochen@chromium.org, hpayer@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1064713005

Cr-Commit-Position: refs/heads/master@{#27786}

rename to ReferenceMap
use ZoneVector for storage
drop dead code

BUG=

Review URL: https://codereview.chromium.org/1081053002

Cr-Commit-Position: refs/heads/master@{#27785}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1082703003

Cr-Commit-Position: refs/heads/master@{#27784}

BUG=

Review URL: https://codereview.chromium.org/1081803002

Cr-Commit-Position: refs/heads/master@{#27783}

This allows the embedder to decide whether it's worthwhile to copy the
contents to avoid materializing a buffer.

BUG=v8:3996
R=dslomov@chromium.org,kbr@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1084513002

Cr-Commit-Position: refs/heads/master@{#27782}

Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}

This is a follow-up to https://codereview.chromium.org/1078093002.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1083623002

Cr-Commit-Position: refs/heads/master@{#27780}

BUG=v8:4023
LOG=NO

Review URL: https://codereview.chromium.org/1081033004

Cr-Commit-Position: refs/heads/master@{#27779}

port 4bd9bdbb (r27751)

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1051323003

Cr-Commit-Position: refs/heads/master@{#27778}

port 74c38122 (r27714)

original commit message:

  [es6] implement spread calls

BUG=

Review URL: https://codereview.chromium.org/1085533002

Cr-Commit-Position: refs/heads/master@{#27777}

TBR=mstarzinger@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1079943003

Cr-Commit-Position: refs/heads/master@{#27776}

This makes the compilers agree on the source position of a message
generated by "throw new Error()", it points to the beginning of the
throw directive.

R=titzer@chromium.org
TEST=message/regress/regress-3995
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1049703002

Cr-Commit-Position: refs/heads/master@{#27775}

This tweak was already present in CrankShaft for the non-AVX case. As it
turns out, it's also relevant even with AVX. Now the same optimization
is applied in case of TurboFan as well.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1081033003

Cr-Commit-Position: refs/heads/master@{#27774}

This commit is a precursor to making lazy arrow function parsing use
similar logic to function(){} argument parsing.

R=arv@chromium.org
BUG=4020
LOG=N

Review URL: https://codereview.chromium.org/1078093002

Cr-Commit-Position: refs/heads/master@{#27773}

Rolling v8/tools/clang to 76fad2f3eb2d3d649bcca82e5ece02d09969e528

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1086453002

Cr-Commit-Position: refs/heads/master@{#27772}

BUG=

Review URL: https://codereview.chromium.org/1077413002

Cr-Commit-Position: refs/heads/master@{#27771}

The ES6 specification does not explicitly state the attributes for the
'next' and 'throw' property descriptors, so their values are defined by
Section 17 [1]:

> Every other data property described in clauses 18 through 26 and in
> Annex B.2 has the attributes
> { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
> unless otherwise specified.

[1]
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-ecmascript-standard-built-in-objects

BUG=v8:3986
LOG=N
R=wingo,arv

Review URL: https://codereview.chromium.org/1051363003

Cr-Commit-Position: refs/heads/master@{#27770}

Reason for revert:
Test failures in string-index and regress-1187524.

This reverts commit b45a664f.

BUG=

Review URL: https://codereview.chromium.org/1050943004

Cr-Commit-Position: refs/heads/master@{#27769}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1072343002

Cr-Commit-Position: refs/heads/master@{#27768}

BUG=v8:3502
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1072573002

Cr-Commit-Position: refs/heads/master@{#27767}

When debugging Handle leaks in io.js we found it very convenient to be
able to Seal some specific (root in our case) scope to prevent Handle
allocations in it, and easily find leakage.

R=yangguo
BUG=

Review URL: https://codereview.chromium.org/1079713002

Cr-Commit-Position: refs/heads/master@{#27766}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1078353002

Cr-Commit-Position: refs/heads/master@{#27765}

Fix c67cb287

Cannot access kStartIndex and kDirectCall parameters as ints on 64-bit BE platforms.

R=yangguo@chromium.org, mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1074203003

Cr-Commit-Position: refs/heads/master@{#27764}

Port 74c38122

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078253004

Cr-Commit-Position: refs/heads/master@{#27763}

Port 725cdc53

Original commit message:
This reduces the overhead of recursive calls when context specialization
is enabled. Based on this it might be possible to further reduce the
overhead by also specializing the call itself.

As a drive-by-fix, port the fast context materialization optimization to
arm and arm64, that was previously only supported on x64 and ia32.

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1078183002

Cr-Commit-Position: refs/heads/master@{#27762}

Port 4e7163ce

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1076263002

Cr-Commit-Position: refs/heads/master@{#27761}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1065863003

Cr-Commit-Position: refs/heads/master@{#27760}

Few pieces leftover which are now effectively dead code and can be safely
deleted.

BUG=v8:3502
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1052963004

Cr-Commit-Position: refs/heads/master@{#27759}

BUG=v8:3018
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1079103005

Cr-Commit-Position: refs/heads/master@{#27758}

Port 35a67b74

Original commit message:
Thanks to some careful assumptions, we can examine the object found at
vector[slot] and trust it's a heap object where the second field is
either a map if it's a WeakCell, or definitely not a map if it's a
Symbol, String or FixedArray. Use this to save a memory read.

BUG=

Review URL: https://codereview.chromium.org/1053843003

Cr-Commit-Position: refs/heads/master@{#27757}