Cr-Commit-Position: refs/heads/master@{#31736}

R=ishell@chromium.org

Committed: https://crrev.com/aa26f5d4a11a1e5655d425ff40ced79c8ecdd55f
Cr-Commit-Position: refs/heads/master@{#31722}

Review URL: https://codereview.chromium.org/1421703004

Cr-Commit-Position: refs/heads/master@{#31735}

R=machenbach@chromium.org
BUG=v8:3079
LOG=N

Review URL: https://codereview.chromium.org/1406293010

Cr-Commit-Position: refs/heads/master@{#31734}

When the property is an accessor property in the receiver but not on the
holder (ES6 "target"), we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1427113002

Cr-Commit-Position: refs/heads/master@{#31733}

Revert of [turbofan] Remove redundant code. (patchset #1 id:1 of https://codereview.chromium.org/1428943004/ )

Reason for revert:
This CL reintroduces all kinds of funny moves for Merges of deferred code, which makes jump threading ineffective.

Original issue's description:
> [turbofan] Remove redundant code.
>
> When I centralized the treatment of memory operands, I forgot to delete
> the old code.
>
> There is a semantic difference between the old and new code. The old
> code was handling either memory operands, or ranges that had a spilled
> predecessor. The new code handles just memory operands. It may
> happen that (using LinearScan) an active range is spilled when trying
> to allocate another range (see SplitAndSpillIntersecting). That may make
> it a candidate for the old version of the code, however, since we would
> have spilled up to a register use, the old code wouldn't have had taken
> effect.
>
> Perf data shows this nuance doesn't make a difference in perf.
>
> BUG=
>
> Committed: https://crrev.com/c03d7a7f03657a452f71277d84e435ed73566327
> Cr-Commit-Position: refs/heads/master@{#31729}

TBR=jarin@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1416293004

Cr-Commit-Position: refs/heads/master@{#31732}

Implement the missing bits for named access to Number values, which is
basically always done on the Number prototype.  Crankshaft only deals
with Number primitives in the polymorphic case, while we generally
support Numbers even for monomorphic access.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1425293004

Cr-Commit-Position: refs/heads/master@{#31731}

R=littledan@chromium.org
BUG=v8:4003
LOG=N

Review URL: https://codereview.chromium.org/1423993006

Cr-Commit-Position: refs/heads/master@{#31730}

When I centralized the treatment of memory operands, I forgot to delete
the old code.

There is a semantic difference between the old and new code. The old
code was handling either memory operands, or ranges that had a spilled
predecessor. The new code handles just memory operands. It may
happen that (using LinearScan) an active range is spilled when trying
to allocate another range (see SplitAndSpillIntersecting). That may make
it a candidate for the old version of the code, however, since we would
have spilled up to a register use, the old code wouldn't have had taken
effect.

Perf data shows this nuance doesn't make a difference in perf.

BUG=

Review URL: https://codereview.chromium.org/1428943004

Cr-Commit-Position: refs/heads/master@{#31729}

       On X87 the count of double register number is landed on the top
       of x87 register stack for deoptimization. (chunyang.dai@intle.com)

R=weiliang.lin@intel.com
BUG=

Review URL: https://codereview.chromium.org/1411223010

Cr-Commit-Position: refs/heads/master@{#31728}

R=adamk

Review URL: https://codereview.chromium.org/1429963002

Cr-Commit-Position: refs/heads/master@{#31727}

Fixing handling of uint32 to be more correct (previously some uint32's
were being interpreted as int32).
Fixing enforcement type matching in comparisons (previously mismatched
expressions could be compared).

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1423563008

Cr-Commit-Position: refs/heads/master@{#31726}

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1410163005

Cr-Commit-Position: refs/heads/master@{#31725}

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1413223011

Cr-Commit-Position: refs/heads/master@{#31724}

Revert of Initialize maths result array in JS. (patchset #1 id:1 of https://codereview.chromium.org/1421703004/ )

Reason for revert:
Failed on
  http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/5020

Original issue's description:
> Initialize maths result array in JS.
>
> R=ishell@chromium.org
>
> Committed: https://crrev.com/aa26f5d4a11a1e5655d425ff40ced79c8ecdd55f
> Cr-Commit-Position: refs/heads/master@{#31722}

TBR=ishell@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1409143011

Cr-Commit-Position: refs/heads/master@{#31723}

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1421703004

Cr-Commit-Position: refs/heads/master@{#31722}

The Interpreter uses the function_data slot in the shared function info, so
can't be used to compile functions which use that field for other reasons,
such as API functions or functions with builtin function ids.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1427143002

Cr-Commit-Position: refs/heads/master@{#31721}

Port 4490ce85

Original commit message:
    Create proper initial map for original constructor (new.target) instead of doing prototype
    transition on the base constructor's initial map. This approach fixes in-object slack tracking
    for subclass instances.
    This CL also fixes subclassing from String.

    It also fixes typed array map smashing done during typed array initialization.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:3101, v8:3330, v8:4419
LOG=N

Review URL: https://codereview.chromium.org/1425353002

Cr-Commit-Position: refs/heads/master@{#31720}

The calling context is the second top-most non-debugger context on the
stack, but that's not necessarily the actually calling context, e.g.,
when a tail-call was used.

BUG=chromium:541703
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1431473003

Cr-Commit-Position: refs/heads/master@{#31719}

The BufferedRawMachineAssemblerTester takes care of storing and loading
parameters to and from memory for these test cases. By using the
BufferedRawMachineAssemblerTester the test cases become more readible.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1409013004

Cr-Commit-Position: refs/heads/master@{#31718}

This adds some initial support for keyed element access to fast,
non-holey JSArray objects.

Also renames PropertyAccessInfoFactory to AccessInfoFactory and
PropertyAccessMode to AccessMode.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1418213010

Cr-Commit-Position: refs/heads/master@{#31717}

V8 zaps (writes 0xdeadbeef) over the mmapped regions when in debug mode.
This causes more resident size than displayed in tracing. So, This CL
adds an api to tell if zapping is done.

BUG=546492
LOG=Y

Review URL: https://codereview.chromium.org/1419523008

Cr-Commit-Position: refs/heads/master@{#31716}

Adds an optimization to not emit unnecessary jumps and dead code in If,
For, While, and do-while statments. When the value of condition is known
at compile time, the code is emitted only for the paths that can be taken.
For example, when the condition is known to be true in an if statmenet
only then block is generated.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1414193006

Cr-Commit-Position: refs/heads/master@{#31715}

R=jkummerow@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1406113007

Cr-Commit-Position: refs/heads/master@{#31714}

This moves the optimization for variables loads targeting lookup slots
in DYNAMIC_GLOBAL and DYNAMIC_LOCAL mode into the AstGraphBuilder. This
way we implicitly get all optimizations that target global loads and
context loads for free.

R=bmeurer@chromium.org
BUG=v8:4513
LOG=n

Review URL: https://codereview.chromium.org/1424943008

Cr-Commit-Position: refs/heads/master@{#31713}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1425693006

Cr-Commit-Position: refs/heads/master@{#31712}

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1424703005

Cr-Commit-Position: refs/heads/master@{#31711}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1425333002

Cr-Commit-Position: refs/heads/master@{#31710}

Revert of [es6] Fix Function and GeneratorFunction built-ins subclassing. (patchset #4 id:80001 of https://codereview.chromium.org/1428823002/ )

Reason for revert:
Buildbot failures

Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1413723008

Cr-Commit-Position: refs/heads/master@{#31709}

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1428823002

Cr-Commit-Position: refs/heads/master@{#31708}

Cr-Commit-Position: refs/heads/master@{#31707}

This ports some code from chromium for using the bundled
toolchain.

BUG=chromium:548586
LOG=n

Review URL: https://codereview.chromium.org/1237803003

Cr-Commit-Position: refs/heads/master@{#31706}

Cr-Commit-Position: refs/heads/master@{#31705}

  port 4490ce85 (r31701).

  original commit message:
    Original issue's description:
    > [es6] Better support for built-ins subclassing.
    >
    > Create proper initial map for original constructor (new.target) instead of doing prototype
    > transition on the base constructor's initial map. This approach fixes in-object slack tracking
    > for subclass instances.
    > This CL also fixes subclassing from String.
    >
    > BUG=v8:3101, v8:3330
    > LOG=Y
    >
    > Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
    > Cr-Commit-Position: refs/heads/master@{#31680}

    It also fixes typed array map smashing done during typed array initialization.

BUG=

Review URL: https://codereview.chromium.org/1432483003

Cr-Commit-Position: refs/heads/master@{#31704}

The compiler can generate a named access for o[x] if x is a compile time
constant that can be turned into a name using ToName (limited to
primitive x values, because other ToName invocations might be observable),
or the KeyedLoadIC/KeyedStoreIC have gather constant name feedback for x
(i.e. the access always goes to the same symbol).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1414013004

Cr-Commit-Position: refs/heads/master@{#31703}

R=littledan@chromium.org
BUG=v8:4305, v8:4343, v8:4344, v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1408223004

Cr-Commit-Position: refs/heads/master@{#31702}

Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype
> transition on the base constructor's initial map. This approach fixes in-object slack tracking
> for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

It also fixes typed array map smashing done during typed array initialization.

BUG=v8:3101, v8:3330, v8:4419
LOG=Y

Review URL: https://codereview.chromium.org/1413033006

Cr-Commit-Position: refs/heads/master@{#31701}

Return undefined for missing properties (or throw an exception in strong
mode). Also do a bit of code cleanup.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1427913003

Cr-Commit-Position: refs/heads/master@{#31700}

Rolling v8/buildtools to c2f259809d5ede3275df5ea0842f0431990c4f98

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1406153016

Cr-Commit-Position: refs/heads/master@{#31699}

This utility makes it possible to test TF graphs that accept parameters of any machine type (even int64 and float64), which are previously problematic due to the complexity of C calling conventions.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1423133005

Cr-Commit-Position: refs/heads/master@{#31698}

Adds an optimization to emit JumpIfToBooleanTrue/False instead
of ToBoolean followed by JumpIfTrue/False if the value in the
accumulator is not boolean.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1426913002

Cr-Commit-Position: refs/heads/master@{#31697}