Port b6419fa2

Now implemented as a builtin that delegates to the InstanceOfStub. That
stub was parameterized to fallback to either Runtime_InstanceOf or to
Runtime_OrdinaryHasInstance depending on the --harmony-instanceof flag.
Once the feature stabilizes and the flag is no longer needed, we can get
rid of this parameterization again.

BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1832053002

Cr-Commit-Position: refs/heads/master@{#35072}

This is another set of changes that replace JR and JALR instructions
with JIC and JIALC for mips32r6. Macroassembler Jump and Call functions
now use JIC and JIALC if branch delay slot is not used. Code patching is
adjusted to work with new changes and few minor fixes are added.

BUG=

Review URL: https://codereview.chromium.org/1807263003

Cr-Commit-Position: refs/heads/master@{#35071}

Rolling v8/buildtools to 80b5126f91be4eb359248d28696746ef09d5be67

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1834743004

Cr-Commit-Position: refs/heads/master@{#35070}

A bug in error printing meant that we failed to do proper type checks
before calling into C++ code, which could lead to RUNTIME_ASSERT
failures if methods are called on alternative receivers. This patch
adds the right type checks.

BUG=chromium:596718
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1831053003

Cr-Commit-Position: refs/heads/master@{#35069}

This patch implements ES2015 RegExp subclassing semantics, namely the
hardest part where RegExp.prototype.exec and certain flag getters can
be overridden in order to provide different behavior. This change is
hidden behind a new flag, --harmony-regexp-exec. The flag guards the
behavior by installing entirely different implementations of the
methods which follow the new semantics.

Preliminary performance tests show a 3-4x regression in the Octane
RegExp benchmark. The new code doesn't call out into several fast
paths that the old code supported, so this is expected.

The patch is tested mostly by test262, where most RegExp tests are fixed,
with the exception of deliberate spec violations for web compatibility,
and for the 'sticky' flag, which is not dynamically read by this patch
in all cases but rather statically compiled into the RegExp. The latter
will require a follow-on patch to implement. A small additional set of
tests verifies one particular case, mostly to check whether the flag
mechanism works.

R=adamk,yangguo@chromium.org
LOG=Y
BUG=v8:4602

Review URL: https://codereview.chromium.org/1596483005

Cr-Commit-Position: refs/heads/master@{#35068}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1830703003

Cr-Commit-Position: refs/heads/master@{#35067}

Makes --ignition cause eager compilation if we aren't building the startup
snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1811553003

Cr-Commit-Position: refs/heads/master@{#35066}

Revert of [Interpreter] Adds support to fetch return value on break at return. (patchset #9 id:160001 of https://codereview.chromium.org/1818873003/ )

Reason for revert:
[Sheriff] Seems to break nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/6019

Original issue's description:
> [Interpreter] Adds support to fetch return value on break at return.
>
> Debugger fetches the return value of a function when we break at return.
> Interpreter holds the return value in accumulator. This is not stored in a
> specified location on stack and hence it is not possible to look it up from
> stack similar to full-codegen or optimized frames. This cl adds support to
> store the value of accumulator on debug breaks. The value of accumulator is
> passed to the runtime function and is then stored in thread local data.
>
> Also changes full-codegen implementation to match that of ignition.
> The return value from full-codegen is also stored in thread local data.
> The return value is fetched directly thread local data instead of
> finding it by iterating over frames.
>
> BUG=v8:4280, v8:4690
> LOG=N
>
> Committed: https://crrev.com/fb65527b75754bcf3b173f16f5d0b04a1c6d9b99
> Cr-Commit-Position: refs/heads/master@{#35060}

TBR=rmcilroy@chromium.org,yangguo@chromium.org,weiliang.lin@intel.com,balazs.kilvady@imgtec.com,jyan@ca.ibm.com,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4690

Review URL: https://codereview.chromium.org/1834733002

Cr-Commit-Position: refs/heads/master@{#35065}

This previously tickled the failure fixed in this issue:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=asm-wasm-deopt
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1766153002

Cr-Commit-Position: refs/heads/master@{#35064}

gc-stress failure believed to have been fixed in:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/embenchen
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1827813006

Cr-Commit-Position: refs/heads/master@{#35063}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1830723003

Cr-Commit-Position: refs/heads/master@{#35062}

Spec http://tc39.github.io/proposal-string-pad-start-end/

BUG=
LOG=Y
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1700003002

Cr-Commit-Position: refs/heads/master@{#35061}

Debugger fetches the return value of a function when we break at return.
Interpreter holds the return value in accumulator. This is not stored in a
specified location on stack and hence it is not possible to look it up from
stack similar to full-codegen or optimized frames. This cl adds support to
store the value of accumulator on debug breaks. The value of accumulator is
passed to the runtime function and is then stored in thread local data.

Also changes full-codegen implementation to match that of ignition.
The return value from full-codegen is also stored in thread local data.
The return value is fetched directly thread local data instead of
finding it by iterating over frames.

BUG=v8:4280, v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1818873003

Cr-Commit-Position: refs/heads/master@{#35060}

Revert of [Interpreter] Remove separate Ignition snapshot. (patchset #2 id:20001 of https://codereview.chromium.org/1833643002/ )

Reason for revert:
Makes nosnap bots timeout due to having to rebuild bytecode handlers.

Original issue's description:
> [Interpreter] Remove separate Ignition snapshot.
>
> Removes the seperate Ignition snapshot and build the Ignition bytecode
> handlers in the default snapshot.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/1798f3fe84faff32ba44e09f6aed79245dd98d80
> Cr-Commit-Position: refs/heads/master@{#35058}

TBR=machenbach@google.com,yangguo@chromium.org,mstarzinger@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1827143002

Cr-Commit-Position: refs/heads/master@{#35059}

Removes the seperate Ignition snapshot and build the Ignition bytecode
handlers in the default snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1833643002

Cr-Commit-Position: refs/heads/master@{#35058}

BUG=chromium:568949
LOG=n
TBR=kjellander@chromium.org, tandrii@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1830153002

Cr-Commit-Position: refs/heads/master@{#35057}

R=jarin@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1828223002

Cr-Commit-Position: refs/heads/master@{#35056}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1827873002

Cr-Commit-Position: refs/heads/master@{#35055}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1832653002

Cr-Commit-Position: refs/heads/master@{#35054}

Based on CL 1777883002.

BUG=chromium:590975
LOG=NO

Review URL: https://codereview.chromium.org/1813963002

Cr-Commit-Position: refs/heads/master@{#35053}

It might happen a script is gone during profiling. Handle that case.

Review URL: https://codereview.chromium.org/1826953003

Cr-Commit-Position: refs/heads/master@{#35052}

Introduce TruncateTaggedToFloat64 and TruncateTaggedToWord32 into the
CodeStubAssembler, which encapsulates the ToNumber truncation and
returns the resulting number as either Float64 or further truncated to
Word32.

R=jarin@chromium.org
BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1827813004

Cr-Commit-Position: refs/heads/master@{#35051}

Rolling v8/build/gyp to 8e8c3178d9d2734a6223b87fbd45ab250baf77e8

Rolling v8/tools/clang to c789a99803595dfa963ba300ac79b760d1304d8c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1834583002

Cr-Commit-Position: refs/heads/master@{#35050}

ES#sec-islabelledfunction specifies that labelled function declarations
may not occur as the body of a control flow construct such as an if
statement. This patch implements those restrictions, which also
eliminates a previous case resulting in a DCHECK failure which is now
a SyntaxError.

BUG=chromium:595309
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1808373003

Cr-Commit-Position: refs/heads/master@{#35049}

This was previously undetected due to a now fixed typing bug.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1823333005

Cr-Commit-Position: refs/heads/master@{#35048}

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1832623003

Cr-Commit-Position: refs/heads/master@{#35047}

Properly convert unsigned literals.
Forbid using unary + on a kAsmInt.
Forbid multiplies other than * 1.0 as being equivalent to unary +.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1832603002

Cr-Commit-Position: refs/heads/master@{#35046}

R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1825333004

Cr-Commit-Position: refs/heads/master@{#35045}

BUG=

Review URL: https://codereview.chromium.org/1826023003

Cr-Commit-Position: refs/heads/master@{#35044}

R=hablich@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1822263003

Cr-Commit-Position: refs/heads/master@{#35043}

BUG=chromium:597310
LOG=NO

Review URL: https://codereview.chromium.org/1828743002

Cr-Commit-Position: refs/heads/master@{#35042}

This got fixed by this change:
    https://crrev.com/32a2ab0c724673961aa145ab63c79a29e6d28fa8

Adding a smaller mjsunit test capturing the issue (was with idiv register allocation).

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=593283
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N
TEST=asm-wasm-copy

Review URL: https://codereview.chromium.org/1820163002

Cr-Commit-Position: refs/heads/master@{#35041}

BUG=590936
LOG=N

Review URL: https://codereview.chromium.org/1816393002

Cr-Commit-Position: refs/heads/master@{#35040}

NOTRY=true

Review URL: https://codereview.chromium.org/1829753002

Cr-Commit-Position: refs/heads/master@{#35039}

Reland of [elements] Minor hardening and cleanup of concat (patchset #1 id:1 of https://codereview.chromium.org/1825363002/ )

Reason for revert:
Test disabled. See:
https://codereview.chromium.org/1830583002/

Original issue's description:
> Revert of [elements] Minor hardening and cleanup of concat (patchset #7 id:120001 of https://codereview.chromium.org/1812753004/ )
>
> Reason for revert:
> [Sheriff] Something seems to leak:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10838
>
> I don't see the direct connection to this CL though...
>
> Original issue's description:
> > [elements] Minor hardening and cleanup of concat
> >
> > BUG=
> >
> > Committed: https://crrev.com/b98b3fbbe3dd14548cb356339f52403c07ef33f4
> > Cr-Commit-Position: refs/heads/master@{#35027}
>
> TBR=jkummerow@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/d30d861a0cb0da11efd3b30eb3d03fbe56b4ba23
> Cr-Commit-Position: refs/heads/master@{#35028}

TBR=jkummerow@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
BUG=

Review URL: https://codereview.chromium.org/1827573003

Cr-Commit-Position: refs/heads/master@{#35038}

Deoptimizing from the stub is fairly slow, so add support for the other fast-path cases to avoid deopts. Notably, push with multi-arg is used by pdfjs.

BUG=chromium:597252
LOG=n

Review URL: https://codereview.chromium.org/1825843002

Cr-Commit-Position: refs/heads/master@{#35037}

NOTRY=true
TBR=oth@chromium.org, rmcilroy@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1830583002

Cr-Commit-Position: refs/heads/master@{#35036}

Reland of [counters] adding runtime call timers for GC (patchset #1 id:1 of https://codereview.chromium.org/1827563003/ )

Reason for revert:
Reverting doesn't help here :/ Will disable the test.

Original issue's description:
> Revert of [counters] adding runtime call timers for GC (patchset #4 id:60001 of https://codereview.chromium.org/1825093002/ )
>
> Reason for revert:
> [Sheriff] ASAN bot is really badass today:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10844
>
> Original issue's description:
> > [counters] adding runtime call timers for GC
> >
> > Adding an additional timer for the GC to make the other runtime call counters
> > more stable.
> >
> > BUG=
> >
> > Committed: https://crrev.com/9ec649638d553a891b0356155f4f15f3a260c1af
> > Cr-Commit-Position: refs/heads/master@{#35033}
>
> TBR=ulan@chromium.org,cbruni@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/a1521c90d54bf4cdaaf4c6ae549d297d5779ac08
> Cr-Commit-Position: refs/heads/master@{#35034}

TBR=ulan@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1826833002

Cr-Commit-Position: refs/heads/master@{#35035}

Revert of [counters] adding runtime call timers for GC (patchset #4 id:60001 of https://codereview.chromium.org/1825093002/ )

Reason for revert:
[Sheriff] ASAN bot is really badass today:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/10844

Original issue's description:
> [counters] adding runtime call timers for GC
>
> Adding an additional timer for the GC to make the other runtime call counters
> more stable.
>
> BUG=
>
> Committed: https://crrev.com/9ec649638d553a891b0356155f4f15f3a260c1af
> Cr-Commit-Position: refs/heads/master@{#35033}

TBR=ulan@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1827563003

Cr-Commit-Position: refs/heads/master@{#35034}

Adding an additional timer for the GC to make the other runtime call counters
more stable.

BUG=

Review URL: https://codereview.chromium.org/1825093002

Cr-Commit-Position: refs/heads/master@{#35033}