According to the ES2015 specification, bound functions are exotic
objects, and thus don't need to be implemented as JSFunctions. So
we introduce a new JSBoundFunction type to represent bound functions
and make them optimizable. This already improves the performance of
calling or constructing bound functions by 10-100x depending on the
use case because we avoid the crazy dance between JavaScript and C++
that was implemented in v8natives.js previously.

There's still room for improvement in the performance of actually
creating bound functions, which is also relevant in practice, but
we already have a plan how to accomplish that later.

The mips/mips64 ports were contributed by akos.palfi@imgtec.com.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=chromium:535408, chromium:571299, v8:4629
LOG=n

Review URL: https://codereview.chromium.org/1542963002

Cr-Commit-Position: refs/heads/master@{#33042}

Rolling v8/tools/clang to 48322a540c208cda85790c2a6df4c4d335b191e1

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1552433002

Cr-Commit-Position: refs/heads/master@{#33041}

Rolling v8/tools/clang to 58034a11a42065e1af1263dfead64df24cb879b9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1545193002

Cr-Commit-Position: refs/heads/master@{#33040}

Review URL: https://codereview.chromium.org/1544743004

Cr-Commit-Position: refs/heads/master@{#33039}

Per request in https://codereview.chromium.org/1047213002/

These files will continue to have a lot of churn in next two months
as we finish support for MIPS r6 instruction set. When things settle
down, we will do a clang-format --full to clean them up. For now,
we'd prefer to be able to do easy diffs, and will do incremental
re-formats as we make changes.

BUG=

Review URL: https://codereview.chromium.org/1546973003

Cr-Commit-Position: refs/heads/master@{#33038}

Follow-up to https://codereview.chromium.org/1495653002, and makes it easier
to maybe have a clang/win build of v8 at some point in the future.

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1549053002

Cr-Commit-Position: refs/heads/master@{#33037}

In Builtins::Generate_Construct, the system was trying to
call ConstructProxy on a Proxy object without a constructor
because it was checking the wrong bit in the Proxy object's
supported operation mask.

TEST=test262/built-ins/Proxy/create-target-is-not-constructor
BUG=

Review URL: https://codereview.chromium.org/1545983002

Cr-Commit-Position: refs/heads/master@{#33036}

  port 866f9e6e (r33026)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1541323005

Cr-Commit-Position: refs/heads/master@{#33035}

  port d3f074b2 (r33024)

  original commit message:
  We'll be able to optimize rest parameters in TurboFan similarly to the arguments array. This CL restores the previous behavior, and a follow-on will enable TurboFan optimization.

  (TBR for rossberg since we discussed the revert beforehand. The only changes are a few lines related to tests and rebasing.)

BUG=

Review URL: https://codereview.chromium.org/1545053002

Cr-Commit-Position: refs/heads/master@{#33034}

atOrUndefined() will return undefined if the index is >= length()

BUG=

Review URL: https://codereview.chromium.org/1541413002

Cr-Commit-Position: refs/heads/master@{#33033}

BUG=

Review URL: https://codereview.chromium.org/1549793003

Cr-Commit-Position: refs/heads/master@{#33032}

Previous CL (https://codereview.chromium.org/1522413002) has a typo.

BUG=chromium:571402,chromium:514080,chromium:527994,v8:4325
LOG=N

Review URL: https://codereview.chromium.org/1541403002

Cr-Commit-Position: refs/heads/master@{#33031}

Revert mistaken removal of JumpIfBlack prototype.

R=hpayer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1544043002

Cr-Commit-Position: refs/heads/master@{#33030}

BUG=chromium:570131
LOG=N

Review URL: https://codereview.chromium.org/1546933002

Cr-Commit-Position: refs/heads/master@{#33029}

Port d3f074b2

Original commit message:
    We'll be able to optimize rest parameters in TurboFan similarly to
    the arguments array. This CL restores the previous behavior, and a
    follow-on will enable TurboFan optimization.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1549743003

Cr-Commit-Position: refs/heads/master@{#33028}

NOTRY=true
TBR=rmcilroy,machenbach

Review URL: https://codereview.chromium.org/1547913003

Cr-Commit-Position: refs/heads/master@{#33027}

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1542113002

Cr-Commit-Position: refs/heads/master@{#33026}

BUG=v8:4642
LOG=N
NOTRY=true
TBR=machenbach@chromium.org,mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1549663004 .

Cr-Commit-Position: refs/heads/master@{#33025}

We'll be able to optimize rest parameters in TurboFan similarly to the arguments array. This CL restores the previous behavior, and a follow-on will enable TurboFan optimization.

(TBR for rossberg since we discussed the revert beforehand. The only changes are a few lines related to tests and rebasing.)

TBR=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1537683002

Cr-Commit-Position: refs/heads/master@{#33024}

Essentially a revert of https://codereview.chromium.org/1346013005 but
preserving the refactorings in elements.cc which happened in the mean time.

drive-by-fix: pass isolate as argument to more functions in elements.cc.

BUG=v8:4606
LOG=y

Review URL: https://codereview.chromium.org/1543563002

Cr-Commit-Position: refs/heads/master@{#33023}

NOTRY=true
TBR=rmcilroy,machenbach

Review URL: https://codereview.chromium.org/1541373002

Cr-Commit-Position: refs/heads/master@{#33022}

BUG=v8:4642
LOG=N
NOTRY=true
R=machenbach@chromium.org,mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1542253002

Cr-Commit-Position: refs/heads/master@{#33021}

Changes LoadGlobal, StoreGlobal, LoadNamedProperty, and StoreNamedProperty to accept
the name of variable instead of index into the constant pool entry. Also made
GetConstantPoolEntry as a private function since it is no longer used outside of
BytecodeArrayBuilder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1546643002

Cr-Commit-Position: refs/heads/master@{#33020}

Adds support for deleting a variable in a lookup slot. Adds a new bytecode,
its implementation and tests. Also adds support for this bytecode to the
bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1542083002

Cr-Commit-Position: refs/heads/master@{#33019}

  port 739c0187 (r33011)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1544013002

Cr-Commit-Position: refs/heads/master@{#33018}

  port 4acca53e(r32996)

  original commit message:
  There's actually no point trying to do Function.prototype.toString in
  JavaScript, as it always calls into C++ at least once, so it only
  complicates things (esp. once we start optimizing bound functions).

  Drive-by-fix: Rename FunctionApply and FunctionCall builtins to also
  reflect the fact that these are builtins in the Function.prototype and
  not on Function itself.

BUG=

Review URL: https://codereview.chromium.org/1548483003

Cr-Commit-Position: refs/heads/master@{#33017}

I believe the code reads easier after this change. The original code
probably dates back to when we had 4 gap positions. Now that there
are only 2, the logic can be simpler by avoiding a loop and instead
treating each case explicitly: no gaps; gaps just at end; gaps at start and
maybe end. That way, it is also  easier to understand how the moves get
pushed downwards. This is what got me to make this change in the first
place: trying to work out a finer grained move optimization.

BUG=

Review URL: https://codereview.chromium.org/1543973002

Cr-Commit-Position: refs/heads/master@{#33016}

Port 739c0187

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1549493005

Cr-Commit-Position: refs/heads/master@{#33015}

Port 4acca53e

Original commit message:
    There's actually no point trying to do Function.prototype.toString in
    JavaScript, as it always calls into C++ at least once, so it only
    complicates things (esp. once we start optimizing bound functions).

    Drive-by-fix: Rename FunctionApply and FunctionCall builtins to also
    reflect the fact that these are builtins in the Function.prototype and
    not on Function itself.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:535408
LOG=n

Review URL: https://codereview.chromium.org/1544833002

Cr-Commit-Position: refs/heads/master@{#33014}

Add API-accessors for [[ProxyTarget]], [[ProxyHandler]]. Additionally
create new proxies and revoke proxies via the API.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1542943002

Cr-Commit-Position: refs/heads/master@{#33013}

These constructors always go through C++ at least twice anyway, so
there's not really a point in trying to implement them in JavaScript.

R=yangguo@chromium.org
BUG=chromium:535408
LOG=n

Review URL: https://codereview.chromium.org/1548623002

Cr-Commit-Position: refs/heads/master@{#33012}

Review URL: https://codereview.chromium.org/1542093002

Cr-Commit-Position: refs/heads/master@{#33011}

Function proxies would not be printed so far since they ended up in Function.prototype.toString which only works with Function as a receiver but no Proxy. Additionally added support for more gracefully dealing with recursive __proto__ structures introduced by proxies.

drive-by-fix: use IS_PROXY if possible in .js files.

BUG=v8:1543
LOG=n

Committed: https://crrev.com/8bfb7189a3472bc9d0820a1bd4534eaaf78ff847
Cr-Commit-Position: refs/heads/master@{#32985}

Review URL: https://codereview.chromium.org/1530293004

Cr-Commit-Position: refs/heads/master@{#33010}

R=caitpotter88@gmail.com, littledan@chromium.org

Review URL: https://codereview.chromium.org/1542813003

Cr-Commit-Position: refs/heads/master@{#33009}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1541143002

Cr-Commit-Position: refs/heads/master@{#33008}

Creating proto-recursive proxies might lead to instanceof while-looping
endlessly in Object::HasInPrototypeChain (For traps we already have stack
guards in place to prevent stack overflows). We prevent this by limiting
the number of proxies we visit in PrototypeIterator to a magic large number.

LOG=n
BUG=v8:1534

Review URL: https://codereview.chromium.org/1542583003

Cr-Commit-Position: refs/heads/master@{#33007}

The GlobalEval JavaScript function was just a small driver for stuff
implemented in C++ anyway, so there's no point in having it around at
all. The next step will be to move the Function constructor to C++ as
well, which is the other user of %CompileString.

R=yangguo@chromium.org
BUG=chromium:535408
LOG=n

Review URL: https://codereview.chromium.org/1540893004

Cr-Commit-Position: refs/heads/master@{#33006}

Consecutive registers are allocated in two passes. First we "reserve"
a set of registers and these get allocated when we actually use them.
If we request for a temporary register before we use all the consecutive
registers, the earlier implementation does not gaurantee that it allocates
outside the reservation for consecutive registers. This could cause problems
for example, in call_func(a, b++, c). This cl fixes
TemporaryRegisterScope::NewRegister, to return a new temporary register
outside the reservation for consecutive registers.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1531273002

Cr-Commit-Position: refs/heads/master@{#33005}

Adds implementation and tests for CreateMappedArguments and
CreateUnmappedArguments to bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1490283003

Cr-Commit-Position: refs/heads/master@{#33004}

Reland of [es6] ship regexp sticky flag. (patchset #1 id:1 of https://codereview.chromium.org/1531043002/ )

Reason for revert:
This can be relanded since the web compatibility fix in https://codereview.chromium.org/1543723002 has been submitted.

Original issue's description:
> Revert of [es6] ship regexp sticky flag. (patchset #2 id:20001 of https://codereview.chromium.org/1509733010/ )
>
> Reason for revert:
> This causes compatibility issues, as documented in https://bugs.chromium.org/p/v8/issues/detail?id=4617#c9
>
> Original issue's description:
> > [es6] ship regexp sticky flag.
> >
> > R=littledan@chromium.org
> > BUG=v8:4342
> > LOG=Y
> >
> > Committed: https://crrev.com/86c2dd4042dc9ce293e004234eb094f2b51d9640
> > Cr-Commit-Position: refs/heads/master@{#32826}
>
> TBR=yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4342

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4342

Review URL: https://codereview.chromium.org/1546563002

Cr-Commit-Position: refs/heads/master@{#33003}