BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/812353002

Cr-Commit-Position: refs/heads/master@{#25905}

Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/792233008/)

Reason for revert:
[sheriff] Still crashes on win32 (XP):
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1380

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0.
>
> This changes to do an early bailout in
> HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
> loop.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org,arv@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/811593004

Cr-Commit-Position: refs/heads/master@{#25872}

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0.

This changes to do an early bailout in
HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
loop.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/792233008

Cr-Commit-Position: refs/heads/master@{#25868}

Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/807173002/)

Reason for revert:
Crashes Win32. It was not flake.

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0 with
> no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
> try again.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/807033003

Cr-Commit-Position: refs/heads/master@{#25853}

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0 with
no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
try again.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/807173002

Cr-Commit-Position: refs/heads/master@{#25851}

Revert of ES6 computed property names (patchset #9 id:160001 of https://codereview.chromium.org/795573005/)

Reason for revert:
Crashes on Win32

http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1357

Test: mjsunit/harmony/computed-property-names
Flags: --stress-opt --always-opt
Command: build\Release\d8.exe --test --random-seed=-233815021 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --harmony-computed-property-names test\mjsunit\mjsunit.js test\mjsunit\harmony\computed-property-names.js

Run #1
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #2
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #3
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> BUG=v8:3754
> LOG=Y

TBR=dslomov@chromium.org,wingo@igalia.com
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/809433002

Cr-Commit-Position: refs/heads/master@{#25825}

This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

BUG=v8:3754
LOG=Y

Review URL: https://codereview.chromium.org/795573005

Cr-Commit-Position: refs/heads/master@{#25821}

Keyed loads should not unconditionally be compiled to element loads. Update KeyedLoadICs to keep track of the key type, so that Hydrogen can emit ICs for string-keyed loads it doesn't have inline support for.

BUG=v8:3167
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/755513003

Cr-Commit-Position: refs/heads/master@{#25817}

Review URL: https://codereview.chromium.org/805523002

Cr-Commit-Position: refs/heads/master@{#25810}

This patch finally allows running and passing tests with vector-based
Load and KeyedLoad ICs.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/767743002

Cr-Commit-Position: refs/heads/master@{#25800}

This completes the first round of optimizations for Map and Set.
All non-key-dependent methods now have a Hydrogen version, and
for keyed methods, string versions are optimized.

Review URL: https://codereview.chromium.org/796503002

Cr-Commit-Position: refs/heads/master@{#25763}

Review URL: https://codereview.chromium.org/779173010

Cr-Commit-Position: refs/heads/master@{#25758}

Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."

Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}

This was previously landed in commit 8599f5f0, but failed the
collections mjsunit test on ia32 with --deopt-every-n=1. The fixed
patch adds a ClearFlag(HValue::kCanOverflow) call after every
arithmetic operation, which should remove all the deopt points in these
intrinsics.

Ideally, it seems like there should be a way to verify that there are
no deopt points for these inline optimized functions, since there's
nothing to deopt to. But I don't currently know of such a thing.

Review URL: https://codereview.chromium.org/782073002

Cr-Commit-Position: refs/heads/master@{#25715}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/783913003

Cr-Commit-Position: refs/heads/master@{#25699}

Revert of Optimize add/set/delete operations for string keys in Maps and Sets (patchset #1 id:1 of https://codereview.chromium.org/777663003/)

Reason for revert:
Deopt fuzzer reports that something's still broken, reverting until
I can create a minimal repro.

Original issue's description:
> Optimize add/set/delete operations for string keys in Maps and Sets
>
> This was previously landed in commit 66e2f60b, but failed the
> collections mjsunit test with --deopt-every-n=1 due to a typo
> in the shrinking code. This patch corrects and simplifies the
> shrinking logic, and the tests now pass.
>
> R=dslomov@chromium.org
>
> Committed: https://chromium.googlesource.com/v8/v8/+/8599f5f047b4400f7f61de9e449b2246c9aad471

TBR=dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/742353006

Cr-Commit-Position: refs/heads/master@{#25696}

This was previously landed in commit 66e2f60b, but failed the
collections mjsunit test with --deopt-every-n=1 due to a typo
in the shrinking code. This patch corrects and simplifies the
shrinking logic, and the tests now pass.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/777663003

Cr-Commit-Position: refs/heads/master@{#25695}

This introduces Hydrogen for %_GetPrototype. The code falls back on
runtime if the object needs access checks or if its prototype is a
hidden prototype.

BUG=None
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/756423006

Cr-Commit-Position: refs/heads/master@{#25694}

R=jarin@chromium.org
BUG=v8:3741
LOG=N

Review URL: https://codereview.chromium.org/762393008

Cr-Commit-Position: refs/heads/master@{#25684}

Revert of Optimize add/set/delete operations for string keys in Maps and Sets (patchset #5 id:70001 of https://codereview.chromium.org/773993002/)

Reason for revert:
Caused test failures in mjsunit/es6/collections with --deopt-every-n-times=1

Original issue's description:
> Optimize add/set/delete operations for string keys in Maps and Sets

TBR=dslomov@chromium.org,arv@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/777233003

Cr-Commit-Position: refs/heads/master@{#25670}

Review URL: https://codereview.chromium.org/773993002

Cr-Commit-Position: refs/heads/master@{#25668}

This patch introduces a new inline runtime function,
%_HasFastPackedElements(), and uses it both in the implementation
of the 'in' operator and in the array builtins to speed
up testing for the existence of an index in an array.

In testing with the microbenchmark on the attached bug,
for example, the runtime goes from 326ms to 66ms.

A reviewer might ask whether the HAS_INDEX macro is worthwhile,
and I tried the same example without it, which pushed the
microbenchmark up to 157ms. So it seems it's worth it to
avoid the function call to IN() if we know we're dealing
with arrays and numbers.

BUG=v8:3701
LOG=n

Review URL: https://codereview.chromium.org/754863002

Cr-Commit-Position: refs/heads/master@{#25665}

The "do I inline?" decision needs many of the same inputs as the "should
I even try to crankshaft?" decision.  This change consolidates these
checks in the numbering pass.  It also removes the is_generator() check,
as that's already handled when visiting the initial Yield expression.

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/775693003

Cr-Commit-Position: refs/heads/master@{#25642}

Review URL: https://codereview.chromium.org/757143002

Cr-Commit-Position: refs/heads/master@{#25625}

R=mvstanton@chromium.org
BUG=chromium:436896
LOG=n

Review URL: https://codereview.chromium.org/755333003

Cr-Commit-Position: refs/heads/master@{#25527}

Per TC39 Nov 2014 decision.

This patch also changes behavior for "legacy const": assignments to sloppy const in strict mode is now also a type error. This fixes v8:2243 and also brings us in compliance with other engines re assignment to function names (see updated webkit test), but might have bigger implications.
That change can easily be reverted by changing Variable::IsSignallingAssignmentToConst.

BUG=v8:3713,v8:2243
LOG=N

Review URL: https://codereview.chromium.org/749633002

Cr-Commit-Position: refs/heads/master@{#25516}

R=rossberg@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/745963002

Cr-Commit-Position: refs/heads/master@{#25468}

BUG=435477
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/751513002

Cr-Commit-Position: refs/heads/master@{#25456}

The bug was an error when copying arrays in crankshaft. If it's a holey smi
array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation
changes from being inserted that deopt on encountering the hole.

Also, prevent inlining array pop() and shift() if the length is read-only.

BUG=435073
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/737383002

Cr-Commit-Position: refs/heads/master@{#25455}

if there is not enough type-feedback to detect that f is Function.prototype.apply.

BUG=v8:3709
LOG=N
TEST=mjsunit/regress/regress-3709

Review URL: https://codereview.chromium.org/736043002

Cr-Commit-Position: refs/heads/master@{#25447}

Due to performance issue.
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735323002

Cr-Commit-Position: refs/heads/master@{#25421}

Code was vulnerable to different evaluation order in Clang.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/726693004

Cr-Commit-Position: refs/heads/master@{#25397}

This reverts commit d40204f8.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735653003

Cr-Commit-Position: refs/heads/master@{#25393}

We were deopting without learning anything.

BUG=v8:3417
LOG=N
R=danno@chromium.org

Review URL: https://codereview.chromium.org/368263003

Cr-Commit-Position: refs/heads/master@{#25392}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/726423002

Cr-Commit-Position: refs/heads/master@{#25387}

Revert "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."
Revert "Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136."

This revert is made in order to revert r25099 which potentially causes renderer hangs.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/722873004

Cr-Commit-Position: refs/heads/master@{#25332}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/668143003

Cr-Commit-Position: refs/heads/master@{#25321}

1. Global{Context,Scope}=>Script{Context,Scope}
2. Enable fixed tests
3. Update comments

R=rossberg@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/716833002

Cr-Commit-Position: refs/heads/master@{#25291}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25291 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This only available under --harmony-classes

BUG=v8:3571
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/718473002

Cr-Commit-Position: refs/heads/master@{#25271}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ishell@chromium.org, adamk@chromium.org, rossberg@chromium.org, verwaest@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/712973002

Cr-Commit-Position: refs/heads/master@{#25264}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00