This refactors the handling of calls of type Call::PROPERTY_CALL to
super properties in AstGraphBuilder::VisitCall. It ensures that the
operand stack is kept in sync with full-codegen so that deopts while
evaluating sub-expressions behave as expected.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4521
BUG=v8:4521
LOG=n

Review URL: https://codereview.chromium.org/1426893003

Cr-Commit-Position: refs/heads/master@{#31652}

For..in introduces 3 new bytecodes ForInPrepare, ForInNext, and
ForInDone to start a for..in loop, get the next element, and check if
the loop is done.

For..in builds upon new LoopBuilder constructs for conditionally
breaking and continuing during iteration: BreakIf{Null|Undefined}
and ContinueIf{Null|Undefined}. New conditional jump bytecodes
support this succinctly: JumpIfNull and JumpIfUndefined.

Add missing check to BytecodeLabel that could allow multiple
forward referencess to the same label which is not supported.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1422033002

Cr-Commit-Position: refs/heads/master@{#31651}

[Interpreter] Ensure we save the BytecodeArray register properly in InterpreterEntryTrampoline builtin.

Ensure that we save the BytecodeArray register in the InterpreterEntryTrampoline
before calling out to the kStackGuard runtime function.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1426863005

Cr-Commit-Position: refs/heads/master@{#31650}

Review URL: https://codereview.chromium.org/1431443002

Cr-Commit-Position: refs/heads/master@{#31649}

Revert of [heap] Decrease incremental marking finalization retry limit. (patchset #1 id:1 of https://codereview.chromium.org/1408183006/ )

Reason for revert:
crashes on webkit_unit_tests V8-Blink Linux 32

Original issue's description:
> [heap] Decrease incremental marking finalization retry limit.
>
> BUG=chromium:548562
> LOG=n
>
> Committed: https://crrev.com/c689f5759b46506c38c84f404ebd8dc326dcb76f
> Cr-Commit-Position: refs/heads/master@{#31647}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1428783004

Cr-Commit-Position: refs/heads/master@{#31648}

BUG=chromium:548562
LOG=n

Review URL: https://codereview.chromium.org/1408183006

Cr-Commit-Position: refs/heads/master@{#31647}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1424983003

Cr-Commit-Position: refs/heads/master@{#31646}

Add support for stores that transition to writable data fields,
based on the BeginRegion/FinishRegion mechanism for atomic regions
in the scheduler.

This is early work and still a bit rough around the edges, and similar
to regular stores, we don't support transitioning stores to double
fields yet.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1406153010

Cr-Commit-Position: refs/heads/master@{#31645}

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1430643003

Cr-Commit-Position: refs/heads/master@{#31644}

R=littledan@chromium.org
BUG=v8:4305, v8:4343, v8:4344, v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1424113003

Cr-Commit-Position: refs/heads/master@{#31643}

R=littledan@chromium.org
BUG=v8:3593
LOG=n

Review URL: https://codereview.chromium.org/1407233013

Cr-Commit-Position: refs/heads/master@{#31642}

Many places in the JavaScript standard library are changed in ES2015 from
getting an integer using ToUint32 to using ToLength. This patch stages
the flag turning on those new semantics.

BUG=v8:3087,v8:4244
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1426673003

Cr-Commit-Position: refs/heads/master@{#31641}

This patch wraps callsites to %AddElement to fall back to adding a
named property in case it is given an argument of 2**32 or greater.
The change is needed because %AddElement is called by Array functions
in various places, and ES2015 changes these Array functions to use
ToLength rather than ToUint32, so several callsites of %AddElement
which used to be reliable array indices may be larger numbers. While
the proper long-term solution may be to call out to
Object.defineProperty, this fix should allow the ToLength semantics
to be shipped while preserving correctness and not requiring a
rewrite.

BUG=v8:4516
LOG=Y
R=adamk
TEST=Interactively ran Array.prototype.slice on an Array-like which
exceeded array bounds, and found that this did not check-fail at
runtime as it did before.
Microbenchmarked this technique against the previous version on a
simple reverse implementation and found at most a 1% slowdown, as
opposed to other techniques, like calling %DefineDataPropertyUnchecked,
which had a 20% slowdown or Object.defineProperty with a 80% slowdown.

Review URL: https://codereview.chromium.org/1420663003

Cr-Commit-Position: refs/heads/master@{#31640}

Review URL: https://codereview.chromium.org/1424233002

Cr-Commit-Position: refs/heads/master@{#31639}

TEST=cctest/test-run-machops/RunUint32MulHighP,RunUint32DivP
BUG=

Review URL: https://codereview.chromium.org/1425003003

Cr-Commit-Position: refs/heads/master@{#31638}

Now that we have a C++ implementation, calling into JS builtins is needlessly inefficient.

Review URL: https://codereview.chromium.org/1410553006

Cr-Commit-Position: refs/heads/master@{#31637}

It was shipped in M46 without incident.

Review URL: https://codereview.chromium.org/1411723007

Cr-Commit-Position: refs/heads/master@{#31636}

These features shipped in M46 without issue.

Review URL: https://codereview.chromium.org/1429653006

Cr-Commit-Position: refs/heads/master@{#31635}

R=bmeurer@chromium.org,hablich@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1416873007

Cr-Commit-Position: refs/heads/master@{#31634}

For platforms that use function descriptors (currently AIX and
PPC64BE), log an external callback's entrypoint address rather than
its function descriptor address.  This allows proper lookup in the
tick processor's symbol table.

R=jkummerow@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1409993006

Cr-Commit-Position: refs/heads/master@{#31633}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1417163004

Cr-Commit-Position: refs/heads/master@{#31632}

Rename ZoneTypeCache to TypeCache and use a single shared (immutable)
instance consistently to cache the most commonly used types. Also serves
as a chokepoint for defining those types, so we don't repeat the
definition (and possible bugs) in various places.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1409763004

Cr-Commit-Position: refs/heads/master@{#31631}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1408283006

Cr-Commit-Position: refs/heads/master@{#31630}

TEST=cctest/test-gap-resolver/FuzzResolver,unittests/MoveOptimizerTest.RemovesRedundantExplicit
BUG=

Review URL: https://codereview.chromium.org/1403373016

Cr-Commit-Position: refs/heads/master@{#31629}

BUG=

Review URL: https://codereview.chromium.org/1420613008

Cr-Commit-Position: refs/heads/master@{#31628}

[heap] Convert overapproximate weak closure phase into finalize incremental marking phase and revisit the root set there.

BUG=chromium:548562
LOG=n

Review URL: https://codereview.chromium.org/1428683002

Cr-Commit-Position: refs/heads/master@{#31627}

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1422373002

Cr-Commit-Position: refs/heads/master@{#31626}

  In order to resolve the sqrt precision issue described in https://codereview.chromium.org/1425763002/.
  we change the implementation of CreateSqrtFunction() implementation of X87 so that the optimize compiler
  and full-compiler implementation are unified.

R=weiliang.lin@intel.com
BUG=

Review URL: https://codereview.chromium.org/1417553007

Cr-Commit-Position: refs/heads/master@{#31625}

R=jkummerow@chromium.org
BUG=v8:4450
LOG=N

Review URL: https://codereview.chromium.org/1411103006

Cr-Commit-Position: refs/heads/master@{#31624}

Only mark the last fallthrough control as deferred, otherwise the
splintering will ruin the code generation for the (maybe likely)
polymorphic cases.

Drive-by-fix: Reduce overall code duplication between JSLoadNamed
and JSStoreNamed specialization.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1424733002

Cr-Commit-Position: refs/heads/master@{#31623}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1413373004

Cr-Commit-Position: refs/heads/master@{#31622}

Float(32|64)Min:
  // (a < b) ? a : b
  fcmp da, db
  fcsel dd, da, db, lo

Float(32|64)Max:
  // (b < a) ? a : b
  fcmp db, da
  fcsel dd, da, db, lo

BUG=

Review URL: https://codereview.chromium.org/1360603003

Cr-Commit-Position: refs/heads/master@{#31621}

Adds support for delete operator, it's implementation and tests.

Adds tests for the following unary operators
  -BitwiseNot
  -Add
  -Sub

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410953003

Cr-Commit-Position: refs/heads/master@{#31620}

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "mapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1403363004

Cr-Commit-Position: refs/heads/master@{#31619}

Typed lowering can lower JSConvertReceiver either based on the operator
hints or the (statically) known receiver type.

R=jarin@chromium.org
BUG=chromium:548557, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1426893002

Cr-Commit-Position: refs/heads/master@{#31618}

Review URL: https://codereview.chromium.org/1423663008

Cr-Commit-Position: refs/heads/master@{#31617}

BUG=

Review URL: https://codereview.chromium.org/1427703003

Cr-Commit-Position: refs/heads/master@{#31616}

Rolling v8/third_party/android_tools to 54492f99c84cab0826a8e656efeb33a1b1bf5a04

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1428663002

Cr-Commit-Position: refs/heads/master@{#31615}

When == is invoked on a Symbol or SIMD vector and an object, the object should
be converted to a primitive with ToPrimitive and then compared again. This means,
for example, that for a Symbol or SIMD vector s, s == Object(s). This patch makes
that change in the implementation of ==. Only the runtime function needed to be
changed, as the code stubs and compiler specializations don't operate on Symbols
or SIMD vectors, and on these types, a fallback to the runtime function is always
used.

BUG=v8:3593
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1421413002

Cr-Commit-Position: refs/heads/master@{#31614}

This fixes a missing SSA-renaming of the callee value used in the frame
state of a call node. An OSR-entry within do-expressions contained in
one of the argument expression can trigger that renaming.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-crbug-546968
BUG=chromium:546968
LOG=n

Review URL: https://codereview.chromium.org/1430483002

Cr-Commit-Position: refs/heads/master@{#31613}