Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG=chromium:595738, chromium:535408
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}

BUG=

Review URL: https://codereview.chromium.org/1823463002

Cr-Commit-Position: refs/heads/master@{#34912}

Rolling v8/tools/clang to a00149535c011c08b6e8cc583a1f10f38d3cdaf9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1817713002

Cr-Commit-Position: refs/heads/master@{#34911}

This revealed one Mozilla test that depended upon a lack
of early error for "with ({}) function ...". The test
has been marked as failing.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1814863005

Cr-Commit-Position: refs/heads/master@{#34910}

BUG=chromium:594974
LOG=N

Review URL: https://codereview.chromium.org/1801313002

Cr-Commit-Position: refs/heads/master@{#34909}

  - Move default parameters tests from harmony/ to es6/ and remove
    non-existent --harmony-default-parameters flag.
  - Remove some non-existent tests from mjsunit.status

Review URL: https://codereview.chromium.org/1812313002

Cr-Commit-Position: refs/heads/master@{#34908}

Dropping newlines in the test macros used in test-asm-validator.
This will make the tests number from 1, rather than 39,
making them easier to read.

LOG=N
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org

Review URL: https://codereview.chromium.org/1812383002

Cr-Commit-Position: refs/heads/master@{#34907}

Revert of Restore per-TypedArray-class length accessors as a perf workaround (patchset #2 id:20001 of https://codereview.chromium.org/1624383003/ )

Reason for revert:
This patch actually seemed to cause a further GameBoy regression! Reverting it seems to address the regression.

Original issue's description:
> Restore per-TypedArray-class length accessors as a perf workaround
>
> This patch is a workaround to the performance regression caused by
> implementing the ES2015 TypedArray prototype chain: Include a
> per-TypedArray-subclass length getter so that the superclass getter does
> not become polymorphic. The patch appears to fix a regression in the
> Gameboy Octane benchmark.
>
> BUG=chromium:579905
> R=adamk
> LOG=Y
>
> Committed: https://crrev.com/03ce7711e474a0ef74f723b30ae1527c89dec010
> Cr-Commit-Position: refs/heads/master@{#33501}

R=adamk@chromium.org
BUG=chromium:579905,chromium:593634
LOG=Y

Review URL: https://codereview.chromium.org/1812143004

Cr-Commit-Position: refs/heads/master@{#34906}

Revert of Inline fast-path interceptor access in the IC utilities (patchset #2 id:20001 of https://codereview.chromium.org/1810083003/ )

Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5506

Original issue's description:
> Inline fast-path interceptor access in the IC utilities
>
> BUG=
>
> Committed: https://crrev.com/b3bda50ddd9e30b718ae7972d9dd0d095113f634
> Cr-Commit-Position: refs/heads/master@{#34892}

TBR=jkummerow@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1819433003

Cr-Commit-Position: refs/heads/master@{#34905}

API change: This adds a new flag skip_html_comments to v8::ScriptOriginOptions. This flag controls whether V8 will attempt to honour HTML-style comments in JS sources.

(That is: Gracefully ignore <!-- ... ---> in JS sources, which was a popular technique in the early days of JavaScript, to prevent non-JS-enabled browsers from displaying script sources to uses.)

The flag defaults to 'true' when using v8::ScriptOrigin constructor, which preserves the existing behaviour. Embedders which are happy with the existing behaviour will thus not need any changes.

BUG=chromium:573887
LOG=Y

Review URL: https://codereview.chromium.org/1801203002

Cr-Commit-Position: refs/heads/master@{#34904}

There are multiple ways we may construct an instruction sequence.
Moved the split edge form validation where they must all eventually
chokepoint to - the register allocation pipeline, which is also the main
and first consumer of this property.

BUG=

Review URL: https://codereview.chromium.org/1810293003

Cr-Commit-Position: refs/heads/master@{#34903}

This removes the Isolate argument from the IsLiteralCompareUndefined
predicate as it is no longer required to determine the answer.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1814823005

Cr-Commit-Position: refs/heads/master@{#34902}

Just sayin'.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1813913004

Cr-Commit-Position: refs/heads/master@{#34901}

This moves the call-sites that ensure we have a feedback vector present
before kicking off a compiler into the actual compilation pipeline. The
backends no longer need to worry about the feedback vector.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1811973006

Cr-Commit-Position: refs/heads/master@{#34900}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1811323002

Cr-Commit-Position: refs/heads/master@{#34899}

Since we clear invalid slots eagerly, there is no need to check if a slot is a valid slot.

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1817523002

Cr-Commit-Position: refs/heads/master@{#34898}

BUG=

Review URL: https://codereview.chromium.org/1813923002

Cr-Commit-Position: refs/heads/master@{#34897}

This is an experiment to see if it affects crash rates on Nexus 9 devices.
A small performance impact (3-4% on Octane) is expected.

BUG=chromium:524337
LOG=n
R=hablich@chromium.org

Review URL: https://codereview.chromium.org/1808243002

Cr-Commit-Position: refs/heads/master@{#34896}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1816463002

Cr-Commit-Position: refs/heads/master@{#34895}

R=jkummerow@chromium.org
BUG=chromium:595657
LOG=N

Review URL: https://codereview.chromium.org/1811913006

Cr-Commit-Position: refs/heads/master@{#34894}

BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}

BUG=

Review URL: https://codereview.chromium.org/1810083003

Cr-Commit-Position: refs/heads/master@{#34892}

This is a pure refactoring CL and should not contain any functional
changes to the code. The following has been done:
- Group compiler.cc into sections for each component.
- Surround local helper methods by anonymous namespace.
- Move implementation of Compiler (API class) together.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1809403002

Cr-Commit-Position: refs/heads/master@{#34891}

Implements Stage 4 proposal from http://rwaldron.github.io/exponentiation-operator/,
without adding any knowledge of the feature to compiler backends.

BUG=v8:3915
LOG=Y
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1678303002

Cr-Commit-Position: refs/heads/master@{#34890}

The higher word (bits 32 - 63) of FPU register is set on zero before
storing result.

TEST=cctest/test-macro-assembler-mips64/Cvt_s_uw_Trunc_uw_s
BUG=

Review URL: https://codereview.chromium.org/1812193003

Cr-Commit-Position: refs/heads/master@{#34889}

Using std::sort on a FixedArray with HeapNumbers is not very GC friendly.
Adding a separate step to properly record possible HeapNumbers.

BUG=chromium:594954
LOG=N

Review URL: https://codereview.chromium.org/1807173002

Cr-Commit-Position: refs/heads/master@{#34888}

The trigger point in question is by now obsolete. The optimized compile
job will itself ensure that deoptimization support is present on the
incoming SharedFunctionInfo, this will make sure to produce baseline
code when necessary. The ScopeInfo is also installed at that point in
time.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1816513002

Cr-Commit-Position: refs/heads/master@{#34887}

Adjust the status file after https://codereview.chromium.org/1784343004

Also removed the tests that are not failing anymore on big-endian.

BUG=

Review URL: https://codereview.chromium.org/1814833003

Cr-Commit-Position: refs/heads/master@{#34886}

This changes the compilation pipeline so that SharedFunctionInfo objects
are always allocated before the various compilers are invoked. It is a
preparation towards having that object available during compile time and
hence reducing the dependency on FunctionLiteral and the need to copy a
lot of the information into the CompilationInfo.

Optimizing compilers already assume the SharedFunctionInfo is present
and the baseline compilers have other heap accesses sprinkled throughout
the compilation process. Duplicating statically available information
from the SharedFunctionInfo within the CompilationInfo has no benefit.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1813803002

Cr-Commit-Position: refs/heads/master@{#34885}

Port 515105a7

Exact simulation of bovc and bnvc instructions.

BUG=

Review URL: https://codereview.chromium.org/1785923011

Cr-Commit-Position: refs/heads/master@{#34884}

We need one message in case the function is not an object, and
another if it was an object but not callable.

R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1814823002

Cr-Commit-Position: refs/heads/master@{#34883}

BUG=chromium:568949
LOG=n
TBR=kjellander@chromium.org, tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1814153002

Cr-Commit-Position: refs/heads/master@{#34882}

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1812923002

Cr-Commit-Position: refs/heads/master@{#34881}

  port 2aa070be (r34863)

  original commit message:
  Repair this to match what the runtime correctly does, by first checking if the
  function is a constructor before we access the prototype.

BUG=

Review URL: https://codereview.chromium.org/1809333002

Cr-Commit-Position: refs/heads/master@{#34880}

  port 992ae64d (r34866)

  original commit message:
  This new intrinsic is used by the desugared ES6 instanceof implementation for
  the cases when the F[@@hasInstance] property is null or undefined.

BUG=

Review URL: https://codereview.chromium.org/1815623002

Cr-Commit-Position: refs/heads/master@{#34879}

It was never being set to false in production (though it was in test-parsing.cc,
due to that test having its own flag-setting logic).

Review URL: https://codereview.chromium.org/1815033002

Cr-Commit-Position: refs/heads/master@{#34878}

Revert of [heap] Enable black allocation. (patchset #1 id:1 of https://codereview.chromium.org/1809983002/ )

Reason for revert:
Continues to cause flaky GPU test failures on Chromium waterfall.
See details at http://crbug.com/595092#c22

Original issue's description:
> [heap] Enable black allocation.
>
> BUG=
>
> Committed: https://crrev.com/447b1156d3bb4aa693175b74780104329ccd41ea
> Cr-Commit-Position: refs/heads/master@{#34847}

TBR=mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:595092

Review URL: https://codereview.chromium.org/1807393002

Cr-Commit-Position: refs/heads/master@{#34877}

This patch fixes two bugs in Array.prototype.concat in conjunction with
subclassing Arrays:
- Create a new property rather than calling Set when adding elements to
  the output array. This means setters are not called.
- If there is an exception thrown from DefineProperty, propagate it
  outwards properly, rather than swallowing it. This can occur, e.g., with
  a Proxy as the new output array.

R=adamk
LOG=Y
BUG=chromium:595319

Review URL: https://codereview.chromium.org/1814933002

Cr-Commit-Position: refs/heads/master@{#34876}

Previously, when a property was non-configurable or the object was
non-extensible, CreateDataProperty might just return false rather than
throwing, even if should_throw was on. This patch fixes that issue.

Tested by running the patch at https://codereview.chromium.org/1814933002
on top of this code and observing the tests to see an exception thrown.

R=adamk
BUG=chromium:595319
LOG=Y

Review URL: https://codereview.chromium.org/1809233002

Cr-Commit-Position: refs/heads/master@{#34875}

This reverts commit 4857110c.

This change was flushing out another issue which is fixed in
  https://codereview.chromium.org/1783283003/

BUG=v8:2999
LOG=N

Review URL: https://codereview.chromium.org/1785933003

Cr-Commit-Position: refs/heads/master@{#34874}