Based on CL https://codereview.chromium.org/871063002/ which needs to land first.

BUG=

Review URL: https://codereview.chromium.org/868453005

Cr-Commit-Position: refs/heads/master@{#26292}

additionally, make the interface match the JSFunction interface

BUG=451405
LOG=N

Review URL: https://codereview.chromium.org/883613003

Cr-Commit-Position: refs/heads/master@{#26291}

BUG=

Review URL: https://codereview.chromium.org/871063002

Cr-Commit-Position: refs/heads/master@{#26290}

BUG=chromium:448711
LOG=y

Review URL: https://codereview.chromium.org/861173004

Cr-Commit-Position: refs/heads/master@{#26289}

BUG=chromium:452033, v8:3846
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/878063002

Cr-Commit-Position: refs/heads/master@{#26288}

Revert of Only use FreeSpace objects in the free list. (patchset #3 id:40001 of https://codereview.chromium.org/876613002/)

Reason for revert:
Test failures

Original issue's description:
> Only use FreeSpace objects in the free list.
>
> This solves an issue with the custom startup snapshot, in cases where
> deserializing the isolate requires more than one page per space.
>
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/66964395108f03220cb6f45ddc73c5965e2c76a9
> Cr-Commit-Position: refs/heads/master@{#26285}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/882443004

Cr-Commit-Position: refs/heads/master@{#26287}

BUG=chromium:452427
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/871373010

Cr-Commit-Position: refs/heads/master@{#26286}

This solves an issue with the custom startup snapshot, in cases where
deserializing the isolate requires more than one page per space.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/876613002

Cr-Commit-Position: refs/heads/master@{#26285}

BUG=chromium:451975
TBR=tandrii@chromium.org
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/870903003

Cr-Commit-Position: refs/heads/master@{#26284}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/877033002

Cr-Commit-Position: refs/heads/master@{#26283}

BUG=v8:3835
LOG=n

Review URL: https://codereview.chromium.org/881653003

Cr-Commit-Position: refs/heads/master@{#26282}

BUG=chromium:451012
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/874983002

Cr-Commit-Position: refs/heads/master@{#26281}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/879583002

Cr-Commit-Position: refs/heads/master@{#26280}

Change stack handling to clarify the usage of reserved MIPS argument slots for mips32.

BUG=

Review URL: https://codereview.chromium.org/867183003

Cr-Commit-Position: refs/heads/master@{#26279}

TEST=mjsunit/string-externalize, others...
BUG=

Review URL: https://codereview.chromium.org/861193008

Cr-Commit-Position: refs/heads/master@{#26278}

Port a7d67a64

Original commit message:
The whole logic in DoMul makes me cry, so I made only the minimal
change to fix the issue...

BUG=v8:451322
LOG=y

Review URL: https://codereview.chromium.org/879473002

Cr-Commit-Position: refs/heads/master@{#26277}

R=mstarzinger@chromium.org
BUG=chromium:451958
LOG=Y

Review URL: https://codereview.chromium.org/880533002

Cr-Commit-Position: refs/heads/master@{#26276}

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/872723003

Cr-Commit-Position: refs/heads/master@{#26275}

BUG=

Review URL: https://codereview.chromium.org/873233002

Cr-Commit-Position: refs/heads/master@{#26274}

This has the added benefit that these functions are now guaranteed not to throw when v8::Value::Is{Uint,Int}32() returned true, even when calling into JavaScript would throw a stack limit error.

BUG=chromium:446097
LOG=y

Review URL: https://codereview.chromium.org/873983003

Cr-Commit-Position: refs/heads/master@{#26273}

BUG=

Review URL: https://codereview.chromium.org/874993003

Cr-Commit-Position: refs/heads/master@{#26272}

Moved and renamed the scripts to fit with git.

These changes require documentation updates, updates of
the release spreadsheet and the buildbot side.

BUG=chromium:451975
TBR=tandrii@chromium.org
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/868473004

Cr-Commit-Position: refs/heads/master@{#26271}

Currently the derived type of a right shift does not narrow the input
type based on the actual shift amount - well it does some narrowing
but more can be down. For patterns such as u32[i>>2], which is very
common is asm.js code, this limits the ability to later prove that an
index bounds check is unnecessary which can have a significant
performance impact.

Review URL: https://codereview.chromium.org/873143002

Cr-Commit-Position: refs/heads/master@{#26270}

This makes some internal renaming, e.g. trunk -> candidates,
bleeding edge -> master, without changing the api.

Also remove some unused bailout steps from the push script.

Remove unused bump version script.

BUG=chromium:451975
TBR=tandrii@chromium.org
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/873213002

Cr-Commit-Position: refs/heads/master@{#26269}

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451013
BUG=chromium:451013
LOG=N

Review URL: https://codereview.chromium.org/873973003

Cr-Commit-Position: refs/heads/master@{#26268}

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/863213003

Cr-Commit-Position: refs/heads/master@{#26267}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/875863002

Cr-Commit-Position: refs/heads/master@{#26266}

Review URL: https://codereview.chromium.org/875853002

Cr-Commit-Position: refs/heads/master@{#26265}

Accessing the builtins object this way prevents sharing of code across
native contexts; instead we now load the builtin from the context of the
JS operation instead.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/879433002

Cr-Commit-Position: refs/heads/master@{#26264}

The lowering of intrinsics is therefore now decoupled from the general
inlining logic.

TEST=cctest,unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/872363002

Cr-Commit-Position: refs/heads/master@{#26263}

Broke after c7b09aac

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/875833002

Cr-Commit-Position: refs/heads/master@{#26262}

The whole logic in DoMul makes me cry, so I made only the minimal
change to fix the issue...

BUG=v8:451322
LOG=y

Review URL: https://codereview.chromium.org/873703002

Cr-Commit-Position: refs/heads/master@{#26261}

Rolling v8/tools/clang to 853a3150b369e5dcd62d7429998bfafe8158e16e

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/868373002

Cr-Commit-Position: refs/heads/master@{#26260}

Rolling v8/build/gyp to b28bd7ddd1438c98f93a8e5383b7daceb572a3fb

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/874753004

Cr-Commit-Position: refs/heads/master@{#26259}

R=arv@chromium.org

Review URL: https://codereview.chromium.org/867923004

Cr-Commit-Position: refs/heads/master@{#26258}

Port c7b09aac

Original commit message:
Along the way:
- Thread isolate parameter explicitly through code that used to
  rely on getting it from the zone.
- Canonicalize the parameter position of isolate and zone for
  affected code
- Change Hydrogen New<> instruction templates to automatically
  pass isolate

LOG=N
BUG=

Review URL: https://codereview.chromium.org/875533002

Cr-Commit-Position: refs/heads/master@{#26257}

Allows unit tests that just need a zone and no isolate to avoid the overhead of
creating one.

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/871843004

Cr-Commit-Position: refs/heads/master@{#26256}

BUG=chromium:451357
LOG=n
TBR=tandrii@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/872813002

Cr-Commit-Position: refs/heads/master@{#26255}

This reverts commit 9ae1c238.

BUG=chromium:446166
LOG=n
NOTRY=true
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/868093002

Cr-Commit-Position: refs/heads/master@{#26254}

ES6 Array.prototype.toString falls back on Object.prototype.toString if method "join" is not callable.

BUG=v8:3793
LOG=Y
R=dslomov@chromium.org, arv@chromium.org

Review URL: https://codereview.chromium.org/835753002

Cr-Commit-Position: refs/heads/master@{#26253}