Commit Graph

10396 Commits

Author SHA1 Message Date
caitpotter88
c12a47a520 [promise] unskip more passing Test262 tests
BUG=v8:4633
LOG=N
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1568433004

Cr-Commit-Position: refs/heads/master@{#33160}
2016-01-07 16:20:08 +00:00
neis
837900ef24 [tests] Fix bogus uses of assertThrows.
Some tests passed a string as second argument to assertThrows, expecting it to
be matched against the exception.  However, assertThrows simply ignored these.
(Some other tests actually seem to use that argument as a comment ...)

This CL
- changes assertThrows to fail if the second argument is not a function,
- adds assertThrowsEquals which compares the exception to a given value using
  assertEquals
- fixes some bogus tests that got exposed by this.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1544793002

Cr-Commit-Position: refs/heads/master@{#33159}
2016-01-07 14:49:21 +00:00
jkummerow
a0d03d729a Fix^3 cast in HasEnumerableElements
Empty FixedDoubleArrays aren't FixedDoubleArrays.

BUG=chromium:569534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1568863002

Cr-Commit-Position: refs/heads/master@{#33158}
2016-01-07 14:47:27 +00:00
titzer
0927a15004 [wasm] OOB test should pass on all architectures.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1567853002

Cr-Commit-Position: refs/heads/master@{#33157}
2016-01-07 14:16:09 +00:00
bmeurer
61f157370d [test] Remove obsolete entries from cctest status file.
R=danno@chromium.org

Review URL: https://codereview.chromium.org/1555823002

Cr-Commit-Position: refs/heads/master@{#33156}
2016-01-07 14:15:07 +00:00
titzer
5341e9fa39 [wasm] Add tests that pass float/double parameters directly for binops and unops.
R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1562883003

Cr-Commit-Position: refs/heads/master@{#33152}
2016-01-07 10:56:18 +00:00
rmcilroy
50cac4436a [Interpreter] Skip a couple more flaky test262 tests on Ignition.
BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1563163003

Cr-Commit-Position: refs/heads/master@{#33151}
2016-01-07 10:22:11 +00:00
rmcilroy
306f195d1e [Interpreter] Add two more Ignition skips for mjsunit/compiler on Arm.
BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1568533005

Cr-Commit-Position: refs/heads/master@{#33150}
2016-01-07 09:58:39 +00:00
bmeurer
b0d0d57d2b [date] Date parser says true even for wrong dates, check twice.
R=yangguo@chromium.org
BUG=chromium:575082
LOG=n

Review URL: https://codereview.chromium.org/1566973002

Cr-Commit-Position: refs/heads/master@{#33149}
2016-01-07 09:30:46 +00:00
rmcilroy
13626e97e0 [Interpreter] Enable most of the mjsunit/compiler tests for Ignition.
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1567633002

Cr-Commit-Position: refs/heads/master@{#33148}
2016-01-07 09:00:11 +00:00
littledan
6e96223750 Add Array support for @@species and subclassing
This patch implements @@species, guarded behind the --harmony-species
flag, on Arrays. Methods which return an Array will instead return
the appropriate instance based on the ArraySpeciesCreate algorithm.
The algorithm is implemented in C++ to get access to realm information
and to implement some Array methods in C++, but it is also accessed
from JavaScript through a new runtime function. A couple interactive
Octane runs show no performance regression with the flag turned off,
but turning --harmony-species on will surely have a significant
regression, as Array methods now heavily use ObjectDefineProperty.

BUG=v8:4093
LOG=Y
R=adamk,cbruni

Review URL: https://codereview.chromium.org/1560763002

Cr-Commit-Position: refs/heads/master@{#33144}
2016-01-07 02:30:01 +00:00
zhengxing.li
48bc94253f X87: [wasm] Change the test case for Run_WasmCall_Float32Sub
The reason is same as the CL #31808 (issue 1430943002, X87: Change the test case for X87 float operations), please refer: https://codereview.chromium.org/1430943002/

  Here is the key comments from CL #31808
  Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function, those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
  The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
  The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

  So we add the following sentence to do type case to keep the same precision for Run_WasmCall_Float32Sub.
  Such as: volatile float expect = *i +/- *j; // *i +/- *j, etc.

BUG=

Review URL: https://codereview.chromium.org/1561023002

Cr-Commit-Position: refs/heads/master@{#33143}
2016-01-07 01:53:22 +00:00
adamk
2367abf025 [es6] Handle function names in object and class literals
This required refactoring ParsePropertyDefinition to pass the parsed
string name as an out param, since ObjectLiteralProperty stores Smis
for Smi-representable property keys.

Computed properties are not yet handled in this patch.

BUG=v8:3699
LOG=n

Review URL: https://codereview.chromium.org/1563923002

Cr-Commit-Position: refs/heads/master@{#33141}
2016-01-06 23:39:15 +00:00
mbrandy
26f2f242d5 PPC: Fix simulator and re-enable wasm tests.
R=bradnelson@chromium.org, titzer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1567753002

Cr-Commit-Position: refs/heads/master@{#33140}
2016-01-06 23:38:12 +00:00
caitpotter88
6cd8535c3b [promise] Test IsPromise() early in Promise.prototype.then()
Addresses TODO by Dan --- simply by moving the check and exception
earlier in the function, before calling NewPromiseCapability() or
loading the constructor.

BUG=v8:4633
LOG=N
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Fixes 'test262/built-ins/Promise/prototype/then/context-check-on-entry'

Review URL: https://codereview.chromium.org/1561193002

Cr-Commit-Position: refs/heads/master@{#33137}
2016-01-06 18:51:28 +00:00
ivica.bogosavljevic
2c63060f11 MIPS64: r6 compact branch optimization.
Several ports to enable r6 compact branch optimizations on MIPS64

Port 3573d3cb58

Original commit message:
MIPS: r6 compact branch optimization.

Port bddf8c9e08

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()

Port 6993cd0de5

Original commit message:
MIPS: Fix 'MIPS:r6 compact branch optimization.'

Jic and jialc compact branch ops are fixed as they does
not have 'forbidden slot' restriction. Also COP1 branches
(CTI instructions) added to IsForbiddenAfterBranchInstr().

Port bb332195d3

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()

Port c91bcf7192

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()
for r6.

BUG=

Review URL: https://codereview.chromium.org/1534183002

Cr-Commit-Position: refs/heads/master@{#33136}
2016-01-06 13:36:41 +00:00
littledan
fcff8588a5 Ship ES2015 sloppy-mode function hoisting, let, class
This patch doesn't ship all features of ES2015 variable/scoping
changes, notably omitting the removal of legacy const. I think
function hoisting, let and class in sloppy mode can stand to
themselves as a package, and the legacy const change is much
riskier and more likely to be reverted, so my intention is to
pursue those as a separate, follow-on patch.

R=adamk@chromium.org
BUG=v8:4285,v8:3305
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1551443002

Cr-Commit-Position: refs/heads/master@{#33133}
2016-01-06 02:03:07 +00:00
bradnelson
e27a3713be Disable more wasm tests.
Disabling a failing PPC wasm test.

BUG=
R=bbudge@chromium.org

Review URL: https://codereview.chromium.org/1561823002

Cr-Commit-Position: refs/heads/master@{#33132}
2016-01-06 00:11:35 +00:00
bradnelson
4c22608133 Disable more crashing / failing wasm tests.
Disabling some tests for ppc, mips, arm.

BUG=
R=bbudge@chromium.org

Review URL: https://codereview.chromium.org/1564553002

Cr-Commit-Position: refs/heads/master@{#33131}
2016-01-05 23:33:12 +00:00
caitpotter88
e4af5cdbf9 [promise] Make Promise.reject match spec, and validate promise capabilities
Correctly validate promise capabilities in NewPromiseCapabilities() and in
GetCapabilitiesExtractor(). Also explicitly follows Promise.race step 2 and
similar cases in the spec, rather than passing tests asserting these steps
are taken in NewPromiseCapability

Also changes Promise.reject to match specification.

Fixes the following test262 tests:

- built-ins/Promise/all/capability-executor-called-twice.js
- built-ins/Promise/all/capability-executor-not-callable.js
- built-ins/Promise/prototype/then/capability-executor-called-twice.js
- built-ins/Promise/prototype/then/capability-executor-not-callable.js
- built-ins/Promise/reject/capability-executor-called-twice.js
- built-ins/Promise/reject/capability-executor-not-callable.js
- built-ins/Promise/resolve/capability-executor-called-twice.js
- built-ins/Promise/resolve/capability-executor-not-callable.js
- built-ins/Promise/race/capability-executor-called-twice.js
- built-ins/Promise/race/capability-executor-not-callable.js
- built-ins/Promise/reject/S25.4.4.4_A3.1_T1.js
- built-ins/Promise/race/S25.4.4.3_A3.1_T2.js

Per v8:3641, mjsunit/es6/debug-promises/throw-with-undefined-reject.js becomes invalid. The exception is thrown before the chain handler is ever invoked, and is caught externally by d8's own handler --- thus evading the uncaught exception event.

BUG=v8:4633, v8:4631, v8:4243, v8:3641
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1531073004

Cr-Commit-Position: refs/heads/master@{#33128}
2016-01-05 22:19:34 +00:00
balazs.kilvady
8d6899c827 MIPS: Add lsa and dlsa r6 instructions.
BUG=

Review URL: https://codereview.chromium.org/1545013002

Cr-Commit-Position: refs/heads/master@{#33127}
2016-01-05 19:46:15 +00:00
bradnelson
0cf8254213 Disable several tests, fix PPC build.
Work around ppc assembler use of Mul, Div macros.

Disable several tests that fail for nosse4.
Disable several tests that fail for msan.

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1562513002

Cr-Commit-Position: refs/heads/master@{#33126}
2016-01-05 19:16:38 +00:00
oth
8109f63fd5 [Interpreter] Add support for jumps using constants with wide operands.
This increases the size of addressable constant pool entries for jumps
to match other bytecodes using operands indexing the constant pool.

This change also introduces reservations for constant pool entries.
Reservations are used for forward jumps to ensure a constant pool entry
will be available when the jump target (label) is bound and the jump is
patched up in the bytecode array.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1546683002

Cr-Commit-Position: refs/heads/master@{#33125}
2016-01-05 19:09:10 +00:00
bradnelson
0e8b7ec8b1 Remove wasm compile time option and enable wasm behind a runtime flag.
Deferring enabling of tests to separate per platform CLs.

R=machenbach@chromium.org,titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1553083003

Cr-Commit-Position: refs/heads/master@{#33123}
2016-01-05 18:06:54 +00:00
machenbach
bb3972f6f8 [test] Skip test for ignition.
NOTRY=true
TBR=rmcilroy@chromium.org, mythria@chromium.org
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1562463002

Cr-Commit-Position: refs/heads/master@{#33121}
2016-01-05 17:05:15 +00:00
mythria
3efce1c77e [Interpreted] Throws an error if rest parameters are used.
Throws an error if rest parameters are used. This feature is not
yet supported in interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1561603002

Cr-Commit-Position: refs/heads/master@{#33120}
2016-01-05 17:04:15 +00:00
jkummerow
b4583c0444 [prototype user tracking] Don't skip JSGlobalProxies
For a prototype chain foo -> global_proxy -> global_object, we used to
register a dependency from foo -> global_object. This is incorrect when
the global_proxy/global_object pairing is modified, e.g. when navigating
in iframes. With this patch, we properly register foo -> global_proxy and
global_proxy -> global_object dependencies.
Additionally, when a prototype's prototype changes from null to something
else, this new usage relation must be registered if there are other users
further down on the prototype chain that might expect a complete chain of
registrations to exist (which was the case before, and must be preserved).

BUG=chromium:571517
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1559323002

Cr-Commit-Position: refs/heads/master@{#33119}
2016-01-05 16:15:48 +00:00
mythria
47d7ae1154 [Interpreter] Pass correct closure argument when creating block context.
After this change, https://codereview.chromium.org/1475383002 we should
not pass Smi 0 for a closure and expect runtime to look it up. We should
pass the correct argument always.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1558153002

Cr-Commit-Position: refs/heads/master@{#33117}
2016-01-05 15:35:33 +00:00
sigurds
3b473d7aad [turbofan] Deopt support for escape analysis
Deopt support is added on two levels. On the IR level,
a new ObjectState node is added, which represenents an
object to be materialized. ObjectState nodes appear as
inputs of FrameState and StateValues nodes. On the
instruction select/code-generation level, the
FrameStateDescriptor class handles the nesting
introduced by ObjectState, and ensures that deopt code
with CAPTURED_OBJECT/DUPLICATED_OBJECT entries are
generated similarly to what crankshaft's escape
analysis does.

Two unittests test correctness of the IR level implementation.

Correctness for instruction selection / code generation
is tested by mjsunit tests.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1485183002

Cr-Commit-Position: refs/heads/master@{#33115}
2016-01-05 13:31:02 +00:00
mythria
a0a8b60643 [Interpreter] Adds support for wide variant of load/store lookup slots.
Adds implementation and tests for wide variant of load/store lookup slots.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1555063002

Cr-Commit-Position: refs/heads/master@{#33111}
2016-01-05 11:36:48 +00:00
bmeurer
065e9c536f [runtime] Migrate several Date builtins to C++.
Almost all of the Date builtins always call into C++ at least once
anyway, so parsing, compiling and executing the JavaScript wrappers
is just a waste of time.  The most important part here is the Date
constructor itself, which is one of the blockers for new.target in
TurboFan, because compiling the Date constructor takes too much time
with TurboFan (for no reason since we end up in C++ anway).

R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1556333002

Cr-Commit-Position: refs/heads/master@{#33109}
2016-01-05 11:05:50 +00:00
mvstanton
c89ddbb7bc Optimized TurboFan support for rest args.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1557883002

Cr-Commit-Position: refs/heads/master@{#33105}
2016-01-05 09:40:41 +00:00
machenbach
a48875c975 [test] Skip tests for ignition.
BUG=v8:4280
LOG=N
TBR=rmcilroy@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1555003004

Cr-Commit-Position: refs/heads/master@{#33104}
2016-01-05 08:50:12 +00:00
aseemgarg
7fdb0da001 Add do-while and conditional and mark non asm nodes as unreachable
TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@chromium.org
BUG=

Add for loop to asm-to-wasm

TEST=asm-wasm.js
R=titzer@chromium.org,bradnelson@google.com

Review URL: https://codereview.chromium.org/1530093002

Cr-Commit-Position: refs/heads/master@{#33101}
2016-01-04 23:47:08 +00:00
littledan
acbd64be36 Accept time zones like GMT-8 in the legacy date parser
In the Date constructor or Date.parse, other browsers will accept time
zones like GMT-8, but before this patch, Chrome would interpret 8 as
8 minutes. This patch interprets GMT-+ a one or two digit number as hours,
not minutes.

R=adamk,jshin@chromium.org
LOG=Y
BUG=chromium:422858

Review URL: https://codereview.chromium.org/1557053002

Cr-Commit-Position: refs/heads/master@{#33100}
2016-01-04 23:25:57 +00:00
jshin
4e18190e69 Timezone name check fix
1. Location names with more than one underscores (e.g. Ho_Chi_Minh)
   didn't work because of the way capturing works with repeated patterns
   in RE. It's now supported by changing the RE to capture the whole string
   and splitting on '_' in the next step.

2. Adds support for location names with a hyphen

3. Adds support for timezone ids with three parts (e.g.
   American/Argentina/Buenos_Aires)

4. Adds special handling of 'au', 'es' and 'of' in zone ids. They need to be kept in lowercase. (see the full list at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones )

5. Adds regression tests for all the above and make the existing tests
   more robust against future ICU changes. ICU canonicalizes zone names to
   deprecated names, but it may change. (
   http://bugs.icu-project.org/trac/ticket/12044 )

BUG=364374
LOG=Y

Review URL: https://codereview.chromium.org/1529363005

Cr-Commit-Position: refs/heads/master@{#33097}
2016-01-04 21:48:04 +00:00
rmcilroy
af95a4dd3e [Interpreter] Add Ignition whitelist for cctests.
Adds an ignition whitelist for cctests.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1557893002

Cr-Commit-Position: refs/heads/master@{#33096}
2016-01-04 21:01:34 +00:00
littledan
fb5cbc2e2d Add a --harmony-species flag, defining @@species on constructors
This patch adds the basis for subclassing TypedArrays, Arrays and
ArrayBuffers through the @@species hook, added in ES2015. This is
the first patch in a series. This patch simply defines the
@@species Symbol and installs it on the appropriate constructors.
The behavior is guarded behind the --harmony-species flag.

R=cbruni
BUG=v8:4093
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1558543002

Cr-Commit-Position: refs/heads/master@{#33095}
2016-01-04 19:39:59 +00:00
caitpotter88
4f9471152c [promise] make Promise.resolve match spec
Fixes a number of test262 tests, including

- built-ins/Promise/resolve/resolve-from-promise-capability.js
- built-ins/Promise/resolve/context-non-object-with-promise.js
- built-ins/Promise/executor-function-length.js

BUG=v8:4633
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1536013002

Cr-Commit-Position: refs/heads/master@{#33094}
2016-01-04 19:16:09 +00:00
oth
c958c98c4f [Interpreter] Bytecodes for exchanging registers.
New bytecodes for making registers with indicies wider than 1-byte
accessible.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1555713002

Cr-Commit-Position: refs/heads/master@{#33091}
2016-01-04 17:38:26 +00:00
rmcilroy
5b4626ad19 [Interpreter] Enable TurboFan for Ignition variant tests.
Adds --turbo to the set of flags run with ignition (making the
configuration pure Ignition+TurboFan except for fallbacks to
full-codegen for catch / eval). Also changes the default
--ignition-filter to allow everything, rather than omit everything.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1537433003

Cr-Commit-Position: refs/heads/master@{#33090}
2016-01-04 17:33:08 +00:00
machenbach
ee66506737 [test] Add ignition test set.
Add control for the ignition test suites. This will be
followed by a change on the infra side that targets the
ignition set instead of the hardcoded mjsunit.

After that, cctest can be enabled in a separate CL. This CL
already includes the logic for running cctest for ignition
on swarming.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1559943002

Cr-Commit-Position: refs/heads/master@{#33089}
2016-01-04 17:26:42 +00:00
jarin
964964541d [turbofan] Fix turbofan-enabling conditions.
This restricts turbofan to turbofan-supported subset for the shipping
configuration ("use asm" and features unsupported by Crankshaft).

Without this, we compile with Turbofan even when there is
try-catch-finally as long as the function is "use asm" or
it contains a feature unsupported by crankshaft but supported
by turbofan (e.g., 'with' statement).

BUG=

Review URL: https://codereview.chromium.org/1552233002

Cr-Commit-Position: refs/heads/master@{#33085}
2016-01-04 14:53:07 +00:00
bmeurer
fed2c416df Use JSObjectVerify instead of trying to reimplement parts of it.
R=verwaest@chromium.org
BUG=chromium:573857
LOG=n

Review URL: https://codereview.chromium.org/1551333002

Cr-Commit-Position: refs/heads/master@{#33083}
2016-01-04 13:50:06 +00:00
verwaest
09c41d9bfd ThrowTypeError should not be constructable, so shouldn't have a prototype.
In addition to ThrowTypeError not being a constructor, it was invalidly set up by simply swapping the map. Swapping the map is insufficient since NewFunction* actually set up the function depending on the used map.

BUG=chromium:573858
LOG=n

Review URL: https://codereview.chromium.org/1552223002

Cr-Commit-Position: refs/heads/master@{#33082}
2016-01-04 13:33:09 +00:00
Benedikt Meurer
5f6bcdaf12 [test] Blacklist mjsunit/regress/regress-417709a while Jaro is working on it.
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1555053002 .

Cr-Commit-Position: refs/heads/master@{#33080}
2016-01-04 12:29:24 +00:00
jarin
140f69d784 [turbofan] Add deopt point for InternalSetPrototype in VisitObjectLiteral.
BUG=572409
LOG=n

Review URL: https://codereview.chromium.org/1555023002

Cr-Commit-Position: refs/heads/master@{#33078}
2016-01-04 09:54:51 +00:00
Benedikt Meurer
2d997d8659 [turbofan] Blacklist test case which needs investigation.
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1557833002 .

Cr-Commit-Position: refs/heads/master@{#33077}
2016-01-04 09:29:14 +00:00
mythria
6d8979c779 [Interpreter] Fixes tests for wide bytecodes.
After this change (https://codereview.chromium.org/1507903004) to type feedback
vector, wide bytecodes for global/keyed/named load-stores were not generated due
to a change in the number of type feedback vector slots. This cl fixes tests to
generate wide bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1546923002

Cr-Commit-Position: refs/heads/master@{#33076}
2016-01-04 09:23:55 +00:00
mythria
d5e849a1dd [Interpreter] Adds support for Load/Store LookupSlots to BytecodeGraphBuilder.
Adds support for loads and stores to lookup slots to BytecodeGraphBuilder.
Also adds tests for them.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1541143003

Cr-Commit-Position: refs/heads/master@{#33075}
2016-01-04 09:20:57 +00:00