Commit Graph

31804 Commits

Author SHA1 Message Date
yangguo
353e1152a5 [liveedit] remove bogus test case.
Removing a bad test case because:
- The test case makes wrong assumptions about compilation. We now
  may run bytecode with the interpreter.
- The test exposes internal implementation details such as pc offset
  of JIT code.
- The test uses a runtime function specially written to cater to, and
  used only by this test. Being unmaintained, this runtime function
  is already returning bogus results, making this test useless.

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2101223002
Cr-Commit-Position: refs/heads/master@{#37312}
2016-06-28 07:40:23 +00:00
neis
41f5f0c0ba Rip out most of our outdated modules implementation.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2081733004
Cr-Commit-Position: refs/heads/master@{#37311}
2016-06-28 07:25:38 +00:00
neis
6dffb07804 Fix behavior of return on yield*.
When calling the return method on a generator suspended inside a yield*, yield*
in turn calls return on its iterable.  If this results in a "done" iterator,
yield* must return immediately, thus terminating the generator.  For some
reason, we didn't terminate the generator but continued right after the yield*.

R=adamk@chromium.org
BUG=v8:5131

Review-Url: https://codereview.chromium.org/2100093002
Cr-Commit-Position: refs/heads/master@{#37310}
2016-06-28 07:10:54 +00:00
yangguo
610a8cbb51 Use source position table for unoptimized code.
R=bmeurer@chromium.org, jgruber@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2095893002
Cr-Commit-Position: refs/heads/master@{#37309}
2016-06-28 05:52:52 +00:00
bjaideep
37538cb2c1 AIX: Update variable name which conflicts with system defined variable
variable hz is defined as a macro in AIX system header
    /usr/include/sys/m_param.h (as "ticks per second of the clock").
    The pre-processor replaces hz with the numeric value defined in
    system header file and therefore emits an error.
    Re-naming variable name to "iz".

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2104483002
Cr-Commit-Position: refs/heads/master@{#37308}
2016-06-28 05:06:30 +00:00
zhengxing.li
fe70bda483 X87: [wasm] Separate compilation from instantiation.
port c1d01aea11 (r37086)

  original commit message:
  Compilation of wasm functions happens before instantiation. Imports are linked afterwards, at instantiation time. Globals and memory are also
  allocated and then tied in via relocation at instantiation time.

  This paves the way for implementing Wasm.compile, a prerequisite to
  offering the compiled code serialization feature.

  Currently, the WasmModule::Compile method just returns a fixed array
  containing the code objects. More appropriate modeling of the compiled module to come.

  Opportunistically centralized the logic on how to update memory
  references, size, and globals, since that logic is the exact same on each
  architecture, except for the actual storing of values back in the
  instruction stream.

BUG=

Review-Url: https://codereview.chromium.org/2100393003
Cr-Commit-Position: refs/heads/master@{#37307}
2016-06-28 05:03:10 +00:00
bmeurer
f50a601ffa [turbofan] Introduce simplified operator NumberAbs.
Add NumberAbs operator to implement an inline version of Math.abs, that
can be optimized and eliminated. We don't use any speculation here, but
for now stick to the information we can infer (this way we avoid the
inherent deopt loops that Crankshaft has around Math.abs).

CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
R=jarin@chromium.org
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2096403002
Cr-Commit-Position: refs/heads/master@{#37306}
2016-06-28 04:37:02 +00:00
v8-autoroll
53d2d24ced Update V8 DEPS.
Rolling v8/build to 87e063014aa0f343b15f5de495a28e5f8572bf8d

Rolling v8/tools/clang to 2ad431ac7823581e1f39c5b770704e1e1ca6cb32

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2101893002
Cr-Commit-Position: refs/heads/master@{#37305}
2016-06-28 03:33:28 +00:00
zhengxing.li
3bc1a84227 X87: [builtins] Introduce proper Float64Cos and Float64Sin.
port c781e83194 (r37072)

  original commit message:
  Import base::ieee754::cos() and base::ieee754::sin() from fdlibm and
  introduce Float64Cos and Float64Sin TurboFan operator based on that,
  similar to what we do for Float64Log. Rewrite Math.cos() and Math.sin()
  as TurboFan builtins and use those operators to also inline Math.cos()
  and Math.sin() into optimized TurboFan functions.

BUG=

Review-Url: https://codereview.chromium.org/2105613002
Cr-Commit-Position: refs/heads/master@{#37304}
2016-06-28 03:07:14 +00:00
mattloring
9480ea4496 Reland of Include file names in trace_turbo output (patchset #1 id:1 of https://codereview.chromium.org/2083153004/ )
Reason for revert:
Ready to test fix and reland.

Original issue's description:
> Revert of Include file names in trace_turbo output (patchset #3 id:40001 of https://codereview.chromium.org/2083863004/ )
>
> Reason for revert:
> Many build bots are failing with a message of the form:
>
> Missing or invalid v8 JSON file: /tmp/tmp2qcEUy_swarming/0/output.json
>
> Can be relanded once we understand why these failures are occuring.
>
> Original issue's description:
> > Include file names in trace_turbo output
> >
> > The trace turbo output will overwrite itself when functions in different
> > files share the same name. Output files now have the form
> > `turbo-<function_name>:<opt_file_name>-<opt_phase>.suffix`.
> >
> > R=ofrobots@google.com
> > BUG=
> >
> > Committed: https://crrev.com/a53b9bf02f31e5647c37e0392afa19f74df1a3ba
> > Cr-Commit-Position: refs/heads/master@{#37199}
>
> TBR=ofrobots@google.com,bmeurer@chromium.org,danno@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/97c2bc362f234bd58515a0faf6af23b4f8ad183a
> Cr-Commit-Position: refs/heads/master@{#37204}

TBR=ofrobots@google.com,bmeurer@chromium.org,danno@chromium.org,machenbach@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2081323007
Cr-Commit-Position: refs/heads/master@{#37303}
2016-06-28 00:04:31 +00:00
caitpotter88
4efd20ab57 [parser] report error for shorthand property "await" in async arrow formals
In addition to recording the BindingPattern error, also record an
AsyncArrowFormalParameters error for shorthand property "await" in object
literals.

BUG=v8:4483, v8:5148
R=littledan@chromium.org, jwolfe@igalia.com, adamk@chromium.org, nikolaos@chromium.org

Review-Url: https://codereview.chromium.org/2100623002
Cr-Commit-Position: refs/heads/master@{#37302}
2016-06-27 21:12:19 +00:00
ddchen
fd2bf837a5 [wasm] improve handling of malformed inputs
When reading malformed input, the length of variable-length types can be very large. Computing operand length with this and adding it to PC will overflow and screw up decode.

This patch switches to unsigned int for arity and lengths, terminates loop analysis on error, adds overflow checking to BranchTableOperand, and adds a unit test.

Review-Url: https://codereview.chromium.org/2052623003
Cr-Commit-Position: refs/heads/master@{#37301}
2016-06-27 20:37:28 +00:00
bjaideep
ea844f9aac PPC: Disable constantpool before calling Stub without frame
Constantpool register is being used with no frame, and
    therefore it points to its parent stub's constantpool
    causing segfault.
    Disable constantpool before CallStub if frame not set.

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2106493002
Cr-Commit-Position: refs/heads/master@{#37300}
2016-06-27 19:44:43 +00:00
machenbach
55f0b92d85 Revert of Refactor CreateApiFunction (patchset #2 id:20001 of https://codereview.chromium.org/2095953002/ )
Reason for revert:
[Sheriff] Changes a layout test. Please rebase upstream if intended:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7742

Original issue's description:
> Refactor CreateApiFunction
>
> BUG=
>
> Committed: https://crrev.com/705574970f3899a6eda0c61130c8c31693df4039
> Cr-Commit-Position: refs/heads/master@{#37290}

TBR=jochen@chromium.org,verwaest@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2099983004
Cr-Commit-Position: refs/heads/master@{#37299}
2016-06-27 18:05:40 +00:00
mythria
08cc2d4fd9 [Interpreter] Remove failure expectation for observer-expectations blink test.
Removes failure expectation for observer-expectations layout test.

BUG=v8:4280,v8:5096
LOG=N

Review-Url: https://codereview.chromium.org/2094353002
Cr-Commit-Position: refs/heads/master@{#37298}
2016-06-27 16:10:20 +00:00
bbudge
257336d26a [RegisterConfiguration] Streamline access to arch defaults, simplify Registers.
Replaces ArchDefault method with Crankshaft and Turbofan getters.
Eliminates IsAllocated method on Register, FloatRegister, DoubleRegister.
Eliminates ToString method too.
Changes call sites to access appropriate arch default RegisterConfiguration.

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2092413002
Cr-Commit-Position: refs/heads/master@{#37297}
2016-06-27 15:31:31 +00:00
ssanfilippo
7d073b03c7 This commit is the first step towards emitting unwinding information in
the .eh_frame format as part of the jitdump generated when
FLAG_perf_prof is enabled. The final goal is allowing precise unwinding
of callchains that include JITted code when profiling V8 using perf.

Unwinding information is stored in the body of code objects after the
code itself, prefixed with its length and aligned to a 8-byte boundary.
A boolean flag in the header signals its presence, resulting in zero
memory overhead when the generation of unwinding info is disabled or
no such information was attached to the code object.

A new jitdump record type (with id 4) is introduced for specifying
optional unwinding information for code load records. The EhFrameHdr
struct is also introduced, together with a constructor to initialise it
from the associated code object.

At this stage no unwinding information is written to the jitdump, but
the infrastructure for doing so is ready in place.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/1993653003
Cr-Commit-Position: refs/heads/master@{#37296}
2016-06-27 15:10:41 +00:00
ivica.bogosavljevic
e1e50f3fff Implement byte swapping instructions on MIPS32 and MIPS64.
BUG=

Review-Url: https://codereview.chromium.org/2069933003
Cr-Commit-Position: refs/heads/master@{#37295}
2016-06-27 14:36:40 +00:00
mstarzinger
4af80298b6 [turbofan] Fix missing lazy deopt in object literals.
This adds a missing lazy bailout point when defining data properties
with computed property names in object literals. The runtime call to
Runtime::kDefineDataPropertyInLiteral can trigger deopts. The necessary
bailout ID already exists and is now properly used.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-621816
BUG=chromium:621816

Review-Url: https://codereview.chromium.org/2099133003
Cr-Commit-Position: refs/heads/master@{#37294}
2016-06-27 13:56:00 +00:00
franzih
e89d8b6a76 [builtins] Migrate StringFromCodePoint to C++.
Instead of a JS implementation that calls C++ runtime functions, migrate String.fromCodePoint() to C++.

BUG=v8:5049

Review-Url: https://codereview.chromium.org/2038563003
Cr-Commit-Position: refs/heads/master@{#37293}
2016-06-27 13:49:19 +00:00
jochen
e09ea0a2b5 Remove thin context as it's dead code
R=yangguo@chromium.org,danno@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2094293002
Cr-Commit-Position: refs/heads/master@{#37292}
2016-06-27 12:51:08 +00:00
ishell
23332fe829 [stubs] Implementing CodeStubAssembler::GetOwnProperty().
This is a building block for GetPropertyStub. It supports querying fast,
slow and global objects without native accessors and interceptors.

BUG=v8:4911
LOG=Y

Review-Url: https://codereview.chromium.org/2079823002
Cr-Commit-Position: refs/heads/master@{#37291}
2016-06-27 12:27:42 +00:00
verwaest
705574970f Refactor CreateApiFunction
BUG=

Review-Url: https://codereview.chromium.org/2095953002
Cr-Commit-Position: refs/heads/master@{#37290}
2016-06-27 12:15:56 +00:00
franzih
7e4c4cb5c5 Fix toString() behavior on proxy objects.
Proxy objects need special treatment in toString(). Usually, we use the
@@toStringTag, if it is set, otherwise we determine the result of toString()
by checking IsArray() and other internal slots. According to
ES2017 19.1.3.6, IsArray() and the internal slots  must be checked first,
then get(@@toStringTag). The result of IsArray() and internal slots is discarded if
@@toStringTag is set. For proxy
objects, we must obey this order, because get() can have side-effects, i.e.,
revoke the proxy. For all other objects, we can skip the check of the
internal slots, if @@toStringTag is set.

BUG=

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090773006
Cr-Commit-Position: refs/heads/master@{#37289}
2016-06-27 12:12:46 +00:00
bbudge
5107f1c135 [Turbofan] Allow compiler to elide complex aliasing code.
- Add a const bool kSimpleFPAliasing variable for each platform so it's
easier for the compiler to eliminate dead code.
- Modify RegisterAllocator to use it.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2101473002
Cr-Commit-Position: refs/heads/master@{#37288}
2016-06-27 11:57:51 +00:00
machenbach
1deca4bafd [gn] Add remaining executables to gn
This adds generate-bytecode-expectations and parser_shell.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2102483002
Cr-Commit-Position: refs/heads/master@{#37287}
2016-06-27 11:57:50 +00:00
jochen
c34cc7a6ff Optionally invoke an interceptor on failed access checks
This superseeds all-can-read/all-can-write properties

BUG=chromium:618305
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2087823002
Cr-Commit-Position: refs/heads/master@{#37286}
2016-06-27 11:49:09 +00:00
bbudge
2db846d531 [arm] Eliminate OperandConverter Float32 and Float64 register methods.
Removes OperandConverter::*Float32* and *Float64* methods.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2091973002
Cr-Commit-Position: refs/heads/master@{#37285}
2016-06-27 11:40:06 +00:00
mlippautz
35720342c3 [heap] Use PageIterator in HeapObjectIterator
BUG=chromium:581412
LOG=N
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2094753002
Cr-Commit-Position: refs/heads/master@{#37284}
2016-06-27 11:37:03 +00:00
franzih
a1debda6c7 Use the instance type to determine if an object is a promise.
We can check if the instance type of an object is JS_PROMISE_TYPE to determine if it is a promise rather than test whether the property promise_state_symbol is present.

BUG=
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2091243002
Cr-Commit-Position: refs/heads/master@{#37283}
2016-06-27 11:07:57 +00:00
zhengxing.li
d1e6a2e21a X87: [builtins] Always pass target and new target to C++ builtins.
port f5b83dec4e (r37061)

  original commit message:
  As a first step towards showing builtin frames in stack traces, we will now
  push target and new target unconditionally.

  Since the various specializations of BuiltinArguments are made redundant by
  this change, we can remove them and all related code.

BUG=

Review-Url: https://codereview.chromium.org/2095323002
Cr-Commit-Position: refs/heads/master@{#37282}
2016-06-27 10:19:10 +00:00
neis
c031c83d3d [ast] Be more precise in --print-scopes about the function kind.
R=littledan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2088813002
Cr-Commit-Position: refs/heads/master@{#37281}
2016-06-27 09:41:02 +00:00
neis
b35623cab3 [ast] Remove unused function Scope::ReportMessage.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2081163002
Cr-Commit-Position: refs/heads/master@{#37280}
2016-06-27 09:38:02 +00:00
franzih
a2dad04f9c Use JS_ERROR_TYPE to check for error objects.
Replace explicit Object::IsErrorObject() and v8::IsNativeError() with macro generated functions Object::IsJSError() and HeapObject::IsJSError().

BUG=

Committed: https://crrev.com/90e4fd136387ca7271d8ea87f4fc667e4f55063b
Cr-Commit-Position: refs/heads/master@{#37244}
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090333002
Cr-Commit-Position: refs/heads/master@{#37279}
2016-06-27 09:34:44 +00:00
ishell
cd18075df7 [ic] Don't pass receiver and name to LoadGlobalIC.
The global object can be loaded from the native context and the name can be loaded in the type feedback metadata.

BUG=chromium:576312

Review-Url: https://codereview.chromium.org/2096653003
Cr-Commit-Position: refs/heads/master@{#37278}
2016-06-27 08:44:53 +00:00
zhengxing.li
f42891c9d9 X87: [builtins] Unify Atanh, Cbrt and Expm1 as exports from flibm.
port 4d4eb61111 (r37058)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2097323002
Cr-Commit-Position: refs/heads/master@{#37277}
2016-06-27 08:39:04 +00:00
franzih
b0016f6dc6 Add missing instance types in switch statement.
BUG=623021

Review-Url: https://codereview.chromium.org/2099923002
Cr-Commit-Position: refs/heads/master@{#37276}
2016-06-27 08:15:49 +00:00
zhengxing.li
b0c5705159 X87: [builtins] Use BUILTIN frame in DatePrototype_GetField.
port 198e09de5a (r37053)

  original commit message:
  Construct a BUILTIN frame before throwing an exception from runtime.

BUG=

Review-Url: https://codereview.chromium.org/2094223002
Cr-Commit-Position: refs/heads/master@{#37275}
2016-06-27 08:03:55 +00:00
machenbach
a93f1bdb83 [test] Sync unittests gn build
Fix after:
https://codereview.chromium.org/2060743002/
https://codereview.chromium.org/2086653003/

BUG=v8:5086, v8:5092, v8:4124
TBR=bmeurer@chromium.org, yangguo@chromium.org,  bbudge@chromium.org

NOTRY=true

Review-Url: https://codereview.chromium.org/2095313002
Cr-Commit-Position: refs/heads/master@{#37274}
2016-06-27 08:03:54 +00:00
bmeurer
bd8a36a727 [turbofan] Fold word32 representation changes for checked constants.
If we know that a constant can be represented as word32, then we don't
need to insert a checked conversion, but just change the constant
appropriately.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2100063002
Cr-Commit-Position: refs/heads/master@{#37273}
2016-06-27 07:46:21 +00:00
thakis
8c8a9f18fb v8 clang/win: Stop passing /FIIntrin.h
See https://codereview.chromium.org/2076483002 for a lengthy reasoning.
The two mysterious files called out there were in boringssl and nacl,
so for v8 this should be a complete no-op.

BUG=chromium:592745

Review-Url: https://codereview.chromium.org/2099843002
Cr-Commit-Position: refs/heads/master@{#37272}
2016-06-27 07:34:35 +00:00
mlippautz
7fda3adb65 [heap] Use hashmap instead of RB tree for ArrayBufferTracker
BUG=chromium:611688
LOG=N
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2098443002
Cr-Commit-Position: refs/heads/master@{#37271}
2016-06-27 07:22:30 +00:00
zhengxing.li
1e18c55edb X87: [builtins] Introduce a proper BUILTIN frame type.
port f47b9e9810 (r37051)

  original commit message:
  This adds a new BUILTIN frame type, which supports variable number of
  arguments for builtins implemented in hand-written native code (we will
  extend this mechanism to TurboFan builtins at some point). Convert the
  Math.max and Math.min builtins to construct a BUILTIN frame if required.

  This does not yet work for C++ builtins, but that'll be the next step.

BUG=

Review-Url: https://codereview.chromium.org/2096283003
Cr-Commit-Position: refs/heads/master@{#37270}
2016-06-27 07:02:16 +00:00
zhengxing.li
9714c98f6a X87: [builtins] Introduce proper Float64Exp operator.
port d5f2ac5e33 (r37047)

  original commit message:
  Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
  TurboFan operator based on that, similar to what we do for Float64Log.
  Rewrite Math.exp() as TurboFan builtin and use that operator to also
  inline Math.exp() into optimized TurboFan functions.

BUG=

Review-Url: https://codereview.chromium.org/2096283002
Cr-Commit-Position: refs/heads/master@{#37269}
2016-06-27 06:32:59 +00:00
zhengxing.li
513240bfdf X87: [builtins] Introduce proper Float64Log2 and Float64Log10 operators.
port d9bf520a22 (r37035)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2100023002
Cr-Commit-Position: refs/heads/master@{#37268}
2016-06-27 05:43:34 +00:00
zhengxing.li
21c4be4d28 X87: [wasm] Support for memory size relocation for asm-wasm.
port c5e3c9bf56 (r37011)

  original commit message:
  Only Intel needed changes, arm and mips work as expected.

BUG=

Review-Url: https://codereview.chromium.org/2094143003
Cr-Commit-Position: refs/heads/master@{#37267}
2016-06-27 04:25:26 +00:00
zhengxing.li
877e428fd9 X87: [wasm] Relocatable Globals.
port 2d1f977c93 (r36978)

  original commit message:
  Support for relocatable globals, to facilitate compilation before
  instantiation.

BUG=

Review-Url: https://codereview.chromium.org/2096273002
Cr-Commit-Position: refs/heads/master@{#37266}
2016-06-27 04:16:37 +00:00
zhengxing.li
d0607218a0 X87: [turbofan] Prevent storing signalling NaNs into holey double arrays.
port 6470ddadf9 (r36950)

  original commit message:
  This introduces SilenceNaN operator, which makes sure that we only
  store quiet NaNs into holey arrays. We omit the NaN silencing code
  at instruction selection time if the input is an operation that
  cannot possibly produce signalling NaNs.

BUG=

Review-Url: https://codereview.chromium.org/2099143002
Cr-Commit-Position: refs/heads/master@{#37265}
2016-06-27 03:38:54 +00:00
v8-autoroll
aee9a72a1e Update V8 DEPS.
Rolling v8/build to 95bb77009ecdeaa992b031b947142fbf7da57ed6

Rolling v8/tools/mb to 62e2d060db3b06208f5d6558db03efd140ecd180

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2098293002
Cr-Commit-Position: refs/heads/master@{#37264}
2016-06-27 03:24:14 +00:00
zhengxing.li
785bb8a3ed X87: Fix arguments object stubs for large arrays.
port e95cfafb67 (r36917)

  original commit message:
  This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
  longer assume that the strict arguments object being allocated will fit
  into new-space. The case where said object needs to move to large object
  space is now handled in the runtime.

BUG=

Review-Url: https://codereview.chromium.org/2100003002
Cr-Commit-Position: refs/heads/master@{#37263}
2016-06-27 02:46:04 +00:00