Port eca5b5d7

Original commit message:
* Hash code is now just done with a private own symbol instead of the hidden string, which predates symbols.
* In the long run we should do all hidden properties this way and get rid of the
hidden magic 0-length string with the zero hash code.  The advantages include
less complexity and being able to do things from JS in a natural way.
* Initially, the performance of weak set regressed, because it's a little harder
to do the lookup in C++.  Instead of heroics in C++ to make things faster I
moved some functionality into JS and got the performance back. JS is supposed to be good at looking up named properties on objects.
* This also changes hash codes of Smis so that they are always Smis.

Performance figures are in the comments to the code review.  Summary: Most of js-perf-test/Collections is neutral.  Set and Map with object keys are 40-50% better.  WeakMap is -5% and WeakSet is +9%.  After the measurements, I fixed global proxies, which cost 1% on most tests and 5% on the weak ones :-(.

In the code review comments is a patch with an example of the heroics we could do in C++ to make lookup faster (I hope we don't have to do this.  Instead of checking for the property, then doing a new lookup to insert it, we could do one lookup and handle the addition immediately).  With the current benchmarks above this buys us nothing, but if we go back to doing more lookups in C++ instead of in stubs and JS then it's a win.

In a similar vein we could give the magic zero hash code to the hash code
symbol.  Then when we look up the hash code we would sometimes see the table
with all the hidden properties.  This dual use of the field for either the hash
code or the table with all hidden properties and the hash code is rather ugly,
and this CL gets rid of it.  I'd be loath to bring it back.  On the benchmarks quoted above it's slightly slower than moving the hash code lookup to JS like in this CL.

One worry is that the benchmark results above are more monomorphic than real
world code, so may be overstating the performance benefits of moving to JS.  I
think this is part of a general issue we have with handling polymorphic code in
JS and any solutions there will benefit this solution, which boils down to
regular property access. Any improvement there will lift all boats.

R=erikcorry@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1157123002

Cr-Commit-Position: refs/heads/master@{#28634}

Port 32de6778

Original commit message:
The reason is that this information will be needed to compute the number of
vector ic slots done at numbering time.

R=mvstanton@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1153113002

Cr-Commit-Position: refs/heads/master@{#28633}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1156113003

Cr-Commit-Position: refs/heads/master@{#28632}

This configures *san in v8 just like in chromium's
common.gypi. I also addresses compilation problems with ICU
and usage of instrumented libc++.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1146863006

Cr-Commit-Position: refs/heads/master@{#28631}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1155683006

Cr-Commit-Position: refs/heads/master@{#28630}

Without this change, wildcards always overwrite the outcomes
of more specific rules. Now we always merge.

Review URL: https://codereview.chromium.org/1153073002

Cr-Commit-Position: refs/heads/master@{#28629}

R=ulan@chromium.org
BUG=chromium:491943
LOG=Y

Review URL: https://codereview.chromium.org/1157993002

Cr-Commit-Position: refs/heads/master@{#28628}

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1157993003

Cr-Commit-Position: refs/heads/master@{#28627}

Cr-Commit-Position: refs/heads/master@{#28626}

This way we don't need to connect (potentially) non-terminating loops
later during control reduction, which saves one forward pass over the
control graph.  Long term we will move the trimming functionality of
the control reducer to the GraphReducer, and get rid of the Finish
method again.

As a bonus, this change also properly rewires Terminate, Throw and
Deoptimize during inlining.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1155683004

Cr-Commit-Position: refs/heads/master@{#28625}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1153963006

Cr-Commit-Position: refs/heads/master@{#28624}

BUG=chromium:492021
LOG=n

Review URL: https://codereview.chromium.org/1154873003

Cr-Commit-Position: refs/heads/master@{#28623}

* Hash code is now just done with a private own symbol instead of the hidden string, which predates symbols.
* In the long run we should do all hidden properties this way and get rid of the
hidden magic 0-length string with the zero hash code.  The advantages include
less complexity and being able to do things from JS in a natural way.
* Initially, the performance of weak set regressed, because it's a little harder
to do the lookup in C++.  Instead of heroics in C++ to make things faster I
moved some functionality into JS and got the performance back. JS is supposed to be good at looking up named properties on objects.
* This also changes hash codes of Smis so that they are always Smis.

Performance figures are in the comments to the code review.  Summary: Most of js-perf-test/Collections is neutral.  Set and Map with object keys are 40-50% better.  WeakMap is -5% and WeakSet is +9%.  After the measurements, I fixed global proxies, which cost 1% on most tests and 5% on the weak ones :-(.

In the code review comments is a patch with an example of the heroics we could do in C++ to make lookup faster (I hope we don't have to do this.  Instead of checking for the property, then doing a new lookup to insert it, we could do one lookup and handle the addition immediately).  With the current benchmarks above this buys us nothing, but if we go back to doing more lookups in C++ instead of in stubs and JS then it's a win.

In a similar vein we could give the magic zero hash code to the hash code
symbol.  Then when we look up the hash code we would sometimes see the table
with all the hidden properties.  This dual use of the field for either the hash
code or the table with all hidden properties and the hash code is rather ugly,
and this CL gets rid of it.  I'd be loath to bring it back.  On the benchmarks quoted above it's slightly slower than moving the hash code lookup to JS like in this CL.

One worry is that the benchmark results above are more monomorphic than real
world code, so may be overstating the performance benefits of moving to JS.  I
think this is part of a general issue we have with handling polymorphic code in
JS and any solutions there will benefit this solution, which boils down to
regular property access. Any improvement there will lift all boats.

R=adamk@chromium.org, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1149863005

Cr-Commit-Position: refs/heads/master@{#28622}

BUG=chromium:491578
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1161583002

Cr-Commit-Position: refs/heads/master@{#28621}

This simplifies the handling of the End node. Based on this CL we will
finally fix terminating every loop from the beginning (via Terminate
nodes) and fix inlining of Throw, Deoptimize and Terminate.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1157023002

Cr-Commit-Position: refs/heads/master@{#28620}

Revert of Fixed a couple of failing DCHECK(has_pending_exception()). (patchset #1 id:1 of https://codereview.chromium.org/1151373002/)

Reason for revert:
Broke V8 Linux - nosnap.

Original issue's description:
> Fixed a couple of failing DCHECK(has_pending_exception()).
>
> BUG=chromium:491062
> LOG=N
>
> Committed: https://crrev.com/62b56507cce3c57a2e1aebce6d34f29b3b64e762
> Cr-Commit-Position: refs/heads/master@{#28617}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:491062

Review URL: https://codereview.chromium.org/1148423004

Cr-Commit-Position: refs/heads/master@{#28619}

BUG=

Review URL: https://codereview.chromium.org/1155163003

Cr-Commit-Position: refs/heads/master@{#28618}

BUG=chromium:491062
LOG=N

Review URL: https://codereview.chromium.org/1151373002

Cr-Commit-Position: refs/heads/master@{#28617}

BUG=v8:4143
R=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1161553004

Cr-Commit-Position: refs/heads/master@{#28616}

The reason is that this information will be needed to compute the number of
vector ic slots done at numbering time.

BUG=

Review URL: https://codereview.chromium.org/1150323002

Cr-Commit-Position: refs/heads/master@{#28615}

BUG=chromium:491481
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1143223004

Cr-Commit-Position: refs/heads/master@{#28614}

This fixes a corner-case where deoptimization while evaluating the
value to a __proto__ property after computed property names appeared
in an object literal, lead to environments not being in sync with
unoptimized code.

R=arv@chromium.org
TEST=mjsunit/harmony/computed-property-names-deopt

Review URL: https://codereview.chromium.org/1158443004

Cr-Commit-Position: refs/heads/master@{#28613}

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1150293002

Cr-Commit-Position: refs/heads/master@{#28612}

TBR=svenpanne@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1159743002

Cr-Commit-Position: refs/heads/master@{#28611}

(Requires the embedder's ExternalSourceStream implementation to cooperate.
 See crrev.com/1154883003 for Blink.)

R=jochen@chromium.org
BUG=chromium:470930
LOG=Y

Review URL: https://codereview.chromium.org/1156733002

Cr-Commit-Position: refs/heads/master@{#28610}

NOTREECHECKS=true
NOTRY=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1161553002

Cr-Commit-Position: refs/heads/master@{#28609}

Revert of Revert of Hook up more import/exports in natives. (patchset #1 id:1 of https://codereview.chromium.org/1154743003/)

Reason for revert:
Unrelated failure that was uncovered by this CL has been fixed (https://codereview.chromium.org/1152243002/)

Original issue's description:
> Revert of Hook up more import/exports in natives. (patchset #3 id:40001 of https://codereview.chromium.org/1154483002/)
>
> Reason for revert:
> [Sheriff] Speculative revert for gc stress failures:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/481
>
> Original issue's description:
> > Hook up more import/exports in natives.
> >
> > R=jkummerow@chromium.org
> >
> > Committed: https://crrev.com/7a918ac9658d11778f39593bfcc19d7c506defd9
> > Cr-Commit-Position: refs/heads/master@{#28573}
> >
> > Committed: https://crrev.com/e13a39dd7f4062898709d7c68900677df0513995
> > Cr-Commit-Position: refs/heads/master@{#28578}
>
> TBR=jkummerow@chromium.org,erik.corry@gmail.com,yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/eb0024d1dbdda5f51b006dd54887404ee6c5cbfc
> Cr-Commit-Position: refs/heads/master@{#28584}

TBR=jkummerow@chromium.org,erik.corry@gmail.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1149773003

Cr-Commit-Position: refs/heads/master@{#28608}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1152243002

Cr-Commit-Position: refs/heads/master@{#28607}

port 9502e91a (r28534)

original commit message:

    This allows you to put iterables into your array literals
    and the will get spread into the array.

      let x = [0, ...range(1, 3)];  // [0, 1, 2]

    This is done by treating the array literal up to the first
    spread element as usual, including using a boiler plate
    array, and then appending the remaining expressions and rest
    expressions.

BUG=

Review URL: https://codereview.chromium.org/1152173002

Cr-Commit-Position: refs/heads/master@{#28606}

port a86384f1 (r28597).

original commit message:

    Also introduce new interface descriptors for the trampoline and full
    versions of those stubs.

    Currently, the stubs aren't functional.

BUG=

Review URL: https://codereview.chromium.org/1148963003

Cr-Commit-Position: refs/heads/master@{#28605}

BUG=chromium:491581
LOG=n
NOTRY=true
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1155983002

Cr-Commit-Position: refs/heads/master@{#28604}

TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1155913002

Cr-Commit-Position: refs/heads/master@{#28603}

R=machenbach@chromium.org, tandrii@chromium.org
BUG=489483
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1150333002

Cr-Commit-Position: refs/heads/master@{#28602}

The blink version is stricter and for parsing it's important that both
decoders behave the same.

BUG=chromium:489944
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1148653007

Cr-Commit-Position: refs/heads/master@{#28601}

Internally, it invokes GetFunction() which returns a MaybeLocal<>

BUG=4134
R=vogelheim@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1156693003

Cr-Commit-Position: refs/heads/master@{#28600}

BUG=chromium:425187
LOG=n

Review URL: https://codereview.chromium.org/1154833002

Cr-Commit-Position: refs/heads/master@{#28599}

R=arv@chromium.org
TEST=mjsunit/harmony/spread-array

Review URL: https://codereview.chromium.org/1154873002

Cr-Commit-Position: refs/heads/master@{#28598}

Also introduce new interface descriptors for the trampoline and full
versions of those stubs.

Currently, the stubs aren't functional.

BUG=

Review URL: https://codereview.chromium.org/1149903005

Cr-Commit-Position: refs/heads/master@{#28597}

Consequence of going whole-hog for vector-based Load/KeyedLoad ICs.

BUG=

Review URL: https://codereview.chromium.org/1152063003

Cr-Commit-Position: refs/heads/master@{#28596}

Implement assembler, disassembler tests for all instructions for mips32 and mips64. Additionally, add missing single precision float instructions for r2 and r6 architecture variants in assembler, simulator and disassembler with corresponding tests.

Review URL: https://codereview.chromium.org/1145223002

Cr-Commit-Position: refs/heads/master@{#28595}