We have evidence (see r34896) that this avoids crashes.

BUG=chromium:524337

Review-Url: https://codereview.chromium.org/1995483002
Cr-Commit-Position: refs/heads/master@{#36317}

BUG=

Review-Url: https://codereview.chromium.org/1984313002
Cr-Commit-Position: refs/heads/master@{#36316}

MIPS64: Fix '[Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.'

Port 39738bc9

BUG=

Review-Url: https://codereview.chromium.org/1990823002
Cr-Commit-Position: refs/heads/master@{#36315}

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1980463003
Cr-Commit-Position: refs/heads/master@{#36314}

When setting a generator function's  "prototype" property to a non-object, the
prototype of new generator instances should be %GeneratorPrototype%, not
%ObjectPrototype%.

R=verwaest@chromium.org
BUG=v8:5011

Review-Url: https://codereview.chromium.org/1982203003
Cr-Commit-Position: refs/heads/master@{#36313}

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1981323002
Cr-Commit-Position: refs/heads/master@{#36312}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1980503002
Cr-Commit-Position: refs/heads/master@{#36311}

In order to support compiling to baseline on return we need to be able to
return to the actual return address. With this change this is what the
Return bytecode now does, removing the need for the
InterpreterExitTrampoline.

This change also removes the InterpreterNotifyDeoptXXX builtins and
unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
change, FullCodegenerator::State is moved to Deoptimize::BailoutState.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/34c9626e2ee56fe805de549697ca5323aed7cb66
Cr-Commit-Position: refs/heads/master@{#36288}

Review-Url: https://codereview.chromium.org/1969423002
Cr-Commit-Position: refs/heads/master@{#36310}

Revert of Ship Turbofan optimization for try-catch and try-finally. (patchset #1 id:1 of https://codereview.chromium.org/1946883003/ )

Reason for revert:
Reverted because of
BUG=chromium:611885

Original issue's description:
> Ship Turbofan optimization for try-catch and try-finally.
>
> Committed: https://crrev.com/b84b01e6d2d8a0ed1e6b9186a5af755bab4bac9a
> Cr-Commit-Position: refs/heads/master@{#36005}

TBR=bmeurer@chromium.org,jarin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/1994543002
Cr-Commit-Position: refs/heads/master@{#36309}

Remove dead code to optimize Int64Constants as branch/select conditions,
because we either have tagged booleans or bits represented as word32.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994533002
Cr-Commit-Position: refs/heads/master@{#36308}

One of the Arm OutOfLineRecordWrite was missing initialiation of must_save_lr

Review-Url: https://codereview.chromium.org/1988623003
Cr-Commit-Position: refs/heads/master@{#36307}

This moves collection of function information from its previous spot in
the standard compiler pipeline (GetSharedFunctionInfo() and
CompileTopLevel()) to its new location in CompileForLiveEdit. Nesting
information is reconstructed by traversing the AST.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1971683002
Cr-Commit-Position: refs/heads/master@{#36306}

  port 8e303dd0 (r36276)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/1989153002
Cr-Commit-Position: refs/heads/master@{#36305}

The type guard should never be used after the effect/control
linearization pass, so making it a simplified operator better
expresses the intended use. Also this way none of the common
operators actually has any dependency on the type system.

Drive-by-fix: Properly print the type parameter to a TypeGuard operator.

BUG=chromium:612142
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994503002
Cr-Commit-Position: refs/heads/master@{#36304}

  port 551e0aa1 (r36275)

  original commit message:
  This adds back the instanceof operator support in the backends and
  introduces a @@hasInstance protector cell on the isolate that guards the
  fast path for the InstanceOfStub. This way we recover the ~10%
  regression on Octane EarleyBoyer in Crankshaft and greatly improve
  TurboFan and Ignition performance of instanceof.

BUG=

Review-Url: https://codereview.chromium.org/1991663002
Cr-Commit-Position: refs/heads/master@{#36303}

These guards are useless anyways once you make it throw the
effect/control linearizer because all memory operations and
calls are connected to the control and/or effect chain anyways
afterwards.

Drive-by-fix: Fail in the InstructionSelector if we ever see
a Guard node.

R=jarin@chromium.org
BUG=chromium:612142

Review-Url: https://codereview.chromium.org/1980383002
Cr-Commit-Position: refs/heads/master@{#36302}

This operator will be used to carry eager frame states, and is hooked up
to the effect chain with a control dependency to avoid hosting out of
control structures.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/1993593002
Cr-Commit-Position: refs/heads/master@{#36301}

Rolling v8/build to 01ca9403e7d6ba63e9a4b6df1cb5cb8397ff7b92

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/1989093002
Cr-Commit-Position: refs/heads/master@{#36300}

BUG=v8:3785

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/1985133002
Cr-Commit-Position: refs/heads/master@{#36299}

1. Normalizer: Use ICU's normalizer2 API instead of deprecated
normalizer. Also uses quick scan method in the API to speed up in the
most common cases (almost normalized and the target is NFC)

2. In all three cases,  replace |v8::Utils::ToLocal(..)| with a more
efficient internal method.

BUG=v8:4983
TEST=intl/string/normal*, intl/collator/*, intl/break-iterator/*
TEST=test262/intl402/Collator/*, test262/built-ins/String/prototype/normalize/*
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/1971943002
Cr-Commit-Position: refs/heads/master@{#36298}

R=joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com,jyan@ca.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/1980913003
Cr-Commit-Position: refs/heads/master@{#36297}

Some IdentifierNames are only included in the set of FutureReservedWords
for strict mode code. Outside of strict mode, these IdentifierNames may
be used as Identifiers. Notably, this includes their use as
BindingIdentifiers in LexicalBindings.

From ES2015 12.1.1 Static Semantics: Early Errors (Identifiers):

> It is a Syntax Error if this phrase is contained in strict mode code
> and the StringValue of IdentifierName is: "implements", "interface",
> "let", "package", "private", "protected", "public", "static", or
> "yield".

http://www.ecma-international.org/ecma-262/6.0/#sec-identifiers-static-semantics-early-errors

Due to a error in its heuristic for disambiguating the `let` token, V8
does not currently allow any of the strict-mode-only FutureReservedWords
to be used as a BindingIdentifier outside of strict mode.

Update V8's heuristic for disambiguating the `let` keyword to account
for strict mode, enabling these IdentifierNames to be used

BUG=v8:4918
LOG=N
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/1891453005
Cr-Commit-Position: refs/heads/master@{#36296}

Makes LogicalNot bytecode not do the ToBoolean operation, and add support in the
peephole optimizer to choose between the appropriate bytecode depending upon
whether the previous bytecode emitted a boolean or not.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1985033002
Cr-Commit-Position: refs/heads/master@{#36295}

Revert of [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline. (patchset #6 id:170001 of https://codereview.chromium.org/1969423002/ )

Reason for revert:
Breaks
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/619

Might only affect pure release builds?

Original issue's description:
> [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.
>
> In order to support compiling to baseline on return we need to be able to
> return to the actual return address. With this change this is what the
> Return bytecode now does, removing the need for the
> InterpreterExitTrampoline.
>
> This change also removes the InterpreterNotifyDeoptXXX builtins and
> unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
> change, FullCodegenerator::State is moved to Deoptimize::BailoutState.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/34c9626e2ee56fe805de549697ca5323aed7cb66
> Cr-Commit-Position: refs/heads/master@{#36288}

TBR=mstarzinger@chromium.org,oth@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review-Url: https://codereview.chromium.org/1986353002
Cr-Commit-Position: refs/heads/master@{#36294}

BUG=chromium:474921
LOG=n
NOTRY=true

Review-Url: https://codereview.chromium.org/1983093002
Cr-Commit-Position: refs/heads/master@{#36293}

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1980543002
Cr-Commit-Position: refs/heads/master@{#36292}

This changes the parser to keep around bodies for asm.js functions when
then asm.js validator is turned on. Eventually the validator will work
on one function at a time, but for now we validate the entire module at
once.

R=rossberg@chromium.org

Review-Url: https://codereview.chromium.org/1981333003
Cr-Commit-Position: refs/heads/master@{#36291}

port 551e0aa1

Original Commit Messag:
  This adds back the instanceof operator support in the backends and
  introduces a @@hasInstance protector cell on the isolate that guards the
  fast path for the InstanceOfStub. This way we recover the ~10%
  regression on Octane EarleyBoyer in Crankshaft and greatly improve
  TurboFan and Ignition performance of instanceof.

R=bmeurer@chromium.org, ishell@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com
TBR=hpayer@chromium.org,rossberg@chromium.org
BUG=chromium:597249, v8:4447
LOG=n

Review-Url: https://codereview.chromium.org/1989523002
Cr-Commit-Position: refs/heads/master@{#36290}

Port f2a58593

Original commit message:
Replace the uses with proper page flag lookups.

BUG=chromium:581412
LOG=N
TEST=mjsunit/allocation-site-info

Review-Url: https://codereview.chromium.org/1989483002
Cr-Commit-Position: refs/heads/master@{#36289}

In order to support compiling to baseline on return we need to be able to
return to the actual return address. With this change this is what the
Return bytecode now does, removing the need for the
InterpreterExitTrampoline.

This change also removes the InterpreterNotifyDeoptXXX builtins and
unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
change, FullCodegenerator::State is moved to Deoptimize::BailoutState.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1969423002
Cr-Commit-Position: refs/heads/master@{#36288}

There's a script for finding them (tools/check-unused-bailouts.sh), but make
sure you don't have an old .bailout-reason.h.swp or such around when using it...

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1986173004
Cr-Commit-Position: refs/heads/master@{#36287}

This makes escape analysis treat all guard nodes in the graph as an
escaping use. We eventually want to properly handle guard nodes, this
just serves as a temporary workaround to get things going.

R=bmeurer@chromium.org
BUG=v8:602595
LOG=n

Review-Url: https://codereview.chromium.org/1972323004
Cr-Commit-Position: refs/heads/master@{#36286}

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1984203002
Cr-Commit-Position: refs/heads/master@{#36285}

This commit introduces a new mode for bytecode_dispatches_report.py
which reports the top sources of dispatches to a given bytecode and
the top destinations of dispatches from the same bytecode.

The bytecode name is passed with --top-dispatches-for-bytecode
(short form: -f), while the number of sources and destinations to
show is controlled with -n.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/1979233002
Cr-Commit-Position: refs/heads/master@{#36284}

Contrary to AstVisitor, which does not implement any traversal logic,
AstTraversalVisitor provides default implementations for each Visit*
function which walk through the AST. It is intended to be used as a base
class for visitors which are only interested in a small portion of the
AST.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/1963243003
Cr-Commit-Position: refs/heads/master@{#36283}

R=bradnelson@chromium.org,titzer@chromium.org
BUG=v8:4203
LOG=Y

Review-Url: https://codereview.chromium.org/1982293002
Cr-Commit-Position: refs/heads/master@{#36282}

R=mstarzinger@chromium.org, oth@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1988573003
Cr-Commit-Position: refs/heads/master@{#36281}

These instructions were available before V8's baseline (ARMv6). V8 can
always assume that they're present.

BUG=

Review-Url: https://codereview.chromium.org/1985013002
Cr-Commit-Position: refs/heads/master@{#36280}

Trying to reland http://crrev.com/1974293002.

This time some blocks have been shuffled around in the AddStub so that the frame still doesn't get built for the fast path.

Also disables the DCHECK(!is_default_snapshot) in snapshot-common.cc if --debug-code is specified. This was causing cctest to fail on arm64 debug builds.

Review-Url: https://codereview.chromium.org/1980333002
Cr-Commit-Position: refs/heads/master@{#36279}

Remove live-edit entries. They have been fixed.
Alphasort.
Group known failures.

TBR=machenbach@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/1985043002
Cr-Commit-Position: refs/heads/master@{#36278}