Note: can't be landed until LoadProperty => LoadNamed is fixed.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1101473004

Cr-Commit-Position: refs/heads/master@{#27979}

BUG=v8:2159
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1099813005

Cr-Commit-Position: refs/heads/master@{#27978}

R=dslomov@chromium.org, marja@chromium.org
BUG=v8:3956
LOG=N

Enforces for constructors that
- the only use of 'super' is the super constructor call
- the only use of 'this' is a property assignment
- both of these must happen at the top-level of the body
- 'this' may only be assigned after the 'super' call
- 'return' may only be used after the last assignment to 'this'

Not yet working for arrow functions (there might be deeper bugs with those).

Review URL: https://codereview.chromium.org/1024063002

Cr-Commit-Position: refs/heads/master@{#27977}

This was a TODO for a while in crankshaft, now ready to address.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1093413002

Cr-Commit-Position: refs/heads/master@{#27976}

Revert of Reland "LayoutDescriptor should inherit from JSTypedArray" (patchset #3 id:40001 of https://codereview.chromium.org/1094333002/)

Reason for revert:
Breaks gbemu

Original issue's description:
> Reland "LayoutDescriptor should inherit from JSTypedArray"
>
> Original issue's description:
> > LayoutDescriptor should inherit from JSTypedArray
> >
> > It can't just inherit from a FixedTypedArray-like type, as we soon
> > assume that a FixedTypedArray-like type is always held by an
> > ArrayBufferView-like type
> >
> > BUG=v8:3996
> > R=ishell@chromium.org,verwaest@chromium.org
> > LOG=n
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

TBR=ishell@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1080403004

Cr-Commit-Position: refs/heads/master@{#27975}

This allows the JSIntrinsicLowering to optimize the cloning of literal
boilerplate objects using either the FastCloneShallowArrayStub or the
FastCloneShallowObjectStub when applicable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1097963002

Cr-Commit-Position: refs/heads/master@{#27974}

Original issue's description:
> LayoutDescriptor should inherit from JSTypedArray
>
> It can't just inherit from a FixedTypedArray-like type, as we soon
> assume that a FixedTypedArray-like type is always held by an
> ArrayBufferView-like type
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

BUG=v8:3996
R=ishell@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1094333002

Cr-Commit-Position: refs/heads/master@{#27973}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095313002

Cr-Commit-Position: refs/heads/master@{#27972}

Originally landed in https://codereview.chromium.org/1061983004;
re-landing after re-landing formal parameter parsing refactors.

R=marja@chromium.org
BUG=v8:4020
LOG=N

Review URL: https://codereview.chromium.org/1077153005

Cr-Commit-Position: refs/heads/master@{#27971}

TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1083923005

Cr-Commit-Position: refs/heads/master@{#27970}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1054763003

Cr-Commit-Position: refs/heads/master@{#27969}

Revert of LayoutDescriptor should inherit from JSTypedArray (patchset #1 id:1 of https://codereview.chromium.org/1084793004/)

Reason for revert:
breaks mjsunit on debug bots

Original issue's description:
> LayoutDescriptor should inherit from JSTypedArray
>
> It can't just inherit from a FixedTypedArray-like type, as we soon
> assume that a FixedTypedArray-like type is always held by an
> ArrayBufferView-like type
>
> BUG=v8:3996
> R=ishell@chromium.org,verwaest@chromium.org
> LOG=n

TBR=ishell@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3996

Review URL: https://codereview.chromium.org/1073053006

Cr-Commit-Position: refs/heads/master@{#27968}

R=dusan.milosavljevic@imgtec.com

Review URL: https://codereview.chromium.org/1101503003

Cr-Commit-Position: refs/heads/master@{#27967}

BUG=

Review URL: https://codereview.chromium.org/1062163005

Cr-Commit-Position: refs/heads/master@{#27966}

Review URL: https://codereview.chromium.org/1097313002

Cr-Commit-Position: refs/heads/master@{#27965}

It can't just inherit from a FixedTypedArray-like type, as we soon
assume that a FixedTypedArray-like type is always held by an
ArrayBufferView-like type

BUG=v8:3996
R=ishell@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1084793004

Cr-Commit-Position: refs/heads/master@{#27964}

this is in preparation for landing the GreedyAllocator

BUG=

Review URL: https://codereview.chromium.org/1100713003

Cr-Commit-Position: refs/heads/master@{#27963}

These tests are based on individual tests from the Emscripten benchmark
suite, which are used to test Emscripten itself. We adopt them to test
asm.js code paths in V8.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1101493002

Cr-Commit-Position: refs/heads/master@{#27962}

Plus some driveby cleanup.

Review URL: https://codereview.chromium.org/1099093002

Cr-Commit-Position: refs/heads/master@{#27961}

This commit is a precursor to making lazy arrow function parsing use
similar logic to function(){} argument parsing.

Originally landed in these three CLs:

  https://codereview.chromium.org/1078093002
  https://codereview.chromium.org/1083623002
  https://codereview.chromium.org/1083953002

These were rolled out due to a performance regression on CodeLoad.  This
patchset will fix that by avoiding creation of a DuplicateFinder in the
full parser.

R=marja@chromium.org
BUG=
LOG=N

Review URL: https://codereview.chromium.org/1100713002

Cr-Commit-Position: refs/heads/master@{#27960}

Also extract non-templated parts of HashTable class into HashTableBase.

Review URL: https://codereview.chromium.org/1095273002

Cr-Commit-Position: refs/heads/master@{#27959}

Baby steps towards saner #includes...

Review URL: https://codereview.chromium.org/1051393003

Cr-Commit-Position: refs/heads/master@{#27958}

BUG=none
R=danno@chromium.org
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1098873002

Cr-Commit-Position: refs/heads/master@{#27957}

If a scavenge is triggered during the GC (via a weak callback or the GC
prologue/epilogue), and another mark-compact is triggered (via the same
unfortunate code path), we end up doing some incremental steps.

BUG=v8:4048
R=dcarney@chromium.org,hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1096693011

Cr-Commit-Position: refs/heads/master@{#27956}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1100673002

Cr-Commit-Position: refs/heads/master@{#27955}

Review URL: https://codereview.chromium.org/1087983007

Cr-Commit-Position: refs/heads/master@{#27954}

Goal is to reduce native context size.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1099573002

Cr-Commit-Position: refs/heads/master@{#27953}

BUG=

Review URL: https://codereview.chromium.org/1098883002

Cr-Commit-Position: refs/heads/master@{#27952}

R=svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/679143002

Cr-Commit-Position: refs/heads/master@{#27951}

BUG=chromium:478747,chromium:478811
LOG=N

Review URL: https://codereview.chromium.org/1096053002

Cr-Commit-Position: refs/heads/master@{#27950}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1096763003

Cr-Commit-Position: refs/heads/master@{#27949}

TBR=machenbach@chromium.org
CC=adamk@chromium.org
BUG=478788
LOG=N

Review URL: https://codereview.chromium.org/1092323003

Cr-Commit-Position: refs/heads/master@{#27948}

Review URL: https://codereview.chromium.org/1098863003

Cr-Commit-Position: refs/heads/master@{#27947}

R=titzer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1094063002

Cr-Commit-Position: refs/heads/master@{#27946}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1099473004

Cr-Commit-Position: refs/heads/master@{#27945}

Revert of Fix logic for doing incremental marking steps on tenured allocation. (patchset #4 id:60001 of https://codereview.chromium.org/1040233003/)

Reason for revert:
Suspected of triggering memory corruption issues, e.g. crbug.com/478401.

Original issue's description:
> Fix logic for doing incremental marking steps on tenured allocation.
>
> R=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/9716468ae63500adb74f5188c47de847e195d71b
> Cr-Commit-Position: refs/heads/master@{#27883}

TBR=hpayer@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1099633002

Cr-Commit-Position: refs/heads/master@{#27944}

We have a bottleneck around storing elements in the array and object prototypes,
but the Push() and Unshift() builtins don't respect them.

Fix this exactly to the level of existing support for stores.

BUG=v8:4043
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1066003003

Cr-Commit-Position: refs/heads/master@{#27943}

The embedder has to take appropriate steps to ensure that the
ArrayBuffer doesn't die while it's accessing the pointer, e.g. keep a
Local handle to it around

BUG=none
R=dslomov@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1095083002

Cr-Commit-Position: refs/heads/master@{#27942}

R=jarin@chromium.org
BUG=chromium:478011
LOG=N

Review URL: https://codereview.chromium.org/1077153003

Cr-Commit-Position: refs/heads/master@{#27941}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1067523003

Cr-Commit-Position: refs/heads/master@{#27940}