Merge v8 from https://chromium.googlesource.com/a/v8/v8.git at 144d97d24909783cb4f72356da27b1b815446053

This commit was generated by merge_from_chromium.py.

Change-Id: I5e07559cb4ee5c0d8a25d6955c1a93095ad161fe

23 files changed, 250 insertions, 165 deletions

diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index 6108c0b92..eb60c3fcb 100644
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -2787,13 +2787,16 @@ void FullCodeGenerator::EmitCall(Call* expr, CallICState::CallType call_type) {
 
 
 void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
-  // r4: copy of the first argument or undefined if it doesn't exist.
+  // r5: copy of the first argument or undefined if it doesn't exist.
   if (arg_count > 0) {
-    __ ldr(r4, MemOperand(sp, arg_count * kPointerSize));
+    __ ldr(r5, MemOperand(sp, arg_count * kPointerSize));
   } else {
-    __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
+    __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
   }
 
+  // r4: the receiver of the enclosing function.
+  __ ldr(r4, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+
   // r3: the receiver of the enclosing function.
   int receiver_offset = 2 + info_->scope()->num_parameters();
   __ ldr(r3, MemOperand(fp, receiver_offset * kPointerSize));
@@ -2805,8 +2808,9 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ mov(r1, Operand(Smi::FromInt(scope()->start_position())));
 
   // Do the runtime call.
+  __ Push(r5);
   __ Push(r4, r3, r2, r1);
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/arm64/full-codegen-arm64.cc b/src/arm64/full-codegen-arm64.cc
index 619568fb0..25a9efd26 100644
--- a/src/arm64/full-codegen-arm64.cc
+++ b/src/arm64/full-codegen-arm64.cc
@@ -2455,11 +2455,12 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   // Prepare to push a copy of the first argument or undefined if it doesn't
   // exist.
   if (arg_count > 0) {
-    __ Peek(x10, arg_count * kXRegSize);
+    __ Peek(x9, arg_count * kXRegSize);
   } else {
-    __ LoadRoot(x10, Heap::kUndefinedValueRootIndex);
+    __ LoadRoot(x9, Heap::kUndefinedValueRootIndex);
   }
 
+  __ Ldr(x10, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   // Prepare to push the receiver of the enclosing function.
   int receiver_offset = 2 + info_->scope()->num_parameters();
   __ Ldr(x11, MemOperand(fp, receiver_offset * kPointerSize));
@@ -2470,10 +2471,10 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ Mov(x13, Smi::FromInt(scope()->start_position()));
 
   // Push.
-  __ Push(x10, x11, x12, x13);
+  __ Push(x9, x10, x11, x12, x13);
 
   // Do the runtime call.
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/compilation-cache.cc b/src/compilation-cache.cc
index 4e02cdd32..aab2fe5b2 100644
--- a/src/compilation-cache.cc
+++ b/src/compilation-cache.cc
@@ -221,10 +221,8 @@ void CompilationCacheScript::Put(Handle<String> source,
 
 
 MaybeHandle<SharedFunctionInfo> CompilationCacheEval::Lookup(
-    Handle<String> source,
-    Handle<Context> context,
-    StrictMode strict_mode,
-    int scope_position) {
+    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+    StrictMode strict_mode, int scope_position) {
   HandleScope scope(isolate());
   // Make sure not to leak the table into the surrounding handle
   // scope. Otherwise, we risk keeping old tables around even after
@@ -233,14 +231,14 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheEval::Lookup(
   int generation;
   for (generation = 0; generation < generations(); generation++) {
     Handle<CompilationCacheTable> table = GetTable(generation);
-    result = table->LookupEval(source, context, strict_mode, scope_position);
+    result = table->LookupEval(source, outer_info, strict_mode, scope_position);
     if (result->IsSharedFunctionInfo()) break;
   }
   if (result->IsSharedFunctionInfo()) {
     Handle<SharedFunctionInfo> function_info =
         Handle<SharedFunctionInfo>::cast(result);
     if (generation != 0) {
-      Put(source, context, function_info, scope_position);
+      Put(source, outer_info, function_info, scope_position);
     }
     isolate()->counters()->compilation_cache_hits()->Increment();
     return scope.CloseAndEscape(function_info);
@@ -252,12 +250,12 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheEval::Lookup(
 
 
 void CompilationCacheEval::Put(Handle<String> source,
-                               Handle<Context> context,
+                               Handle<SharedFunctionInfo> outer_info,
                                Handle<SharedFunctionInfo> function_info,
                                int scope_position) {
   HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetFirstTable();
-  table = CompilationCacheTable::PutEval(table, source, context,
+  table = CompilationCacheTable::PutEval(table, source, outer_info,
                                          function_info, scope_position);
   SetFirstTable(table);
 }
@@ -324,20 +322,18 @@ MaybeHandle<SharedFunctionInfo> CompilationCache::LookupScript(
 
 
 MaybeHandle<SharedFunctionInfo> CompilationCache::LookupEval(
-    Handle<String> source,
-    Handle<Context> context,
-    StrictMode strict_mode,
-    int scope_position) {
+    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+    Handle<Context> context, StrictMode strict_mode, int scope_position) {
   if (!IsEnabled()) return MaybeHandle<SharedFunctionInfo>();
 
   MaybeHandle<SharedFunctionInfo> result;
   if (context->IsNativeContext()) {
-    result = eval_global_.Lookup(
-        source, context, strict_mode, scope_position);
+    result =
+        eval_global_.Lookup(source, outer_info, strict_mode, scope_position);
   } else {
     DCHECK(scope_position != RelocInfo::kNoPosition);
-    result = eval_contextual_.Lookup(
-        source, context, strict_mode, scope_position);
+    result = eval_contextual_.Lookup(source, outer_info, strict_mode,
+                                     scope_position);
   }
   return result;
 }
@@ -361,6 +357,7 @@ void CompilationCache::PutScript(Handle<String> source,
 
 
 void CompilationCache::PutEval(Handle<String> source,
+                               Handle<SharedFunctionInfo> outer_info,
                                Handle<Context> context,
                                Handle<SharedFunctionInfo> function_info,
                                int scope_position) {
@@ -368,10 +365,10 @@ void CompilationCache::PutEval(Handle<String> source,
 
   HandleScope scope(isolate());
   if (context->IsNativeContext()) {
-    eval_global_.Put(source, context, function_info, scope_position);
+    eval_global_.Put(source, outer_info, function_info, scope_position);
   } else {
     DCHECK(scope_position != RelocInfo::kNoPosition);
-    eval_contextual_.Put(source, context, function_info, scope_position);
+    eval_contextual_.Put(source, outer_info, function_info, scope_position);
   }
 }
 
diff --git a/src/compilation-cache.h b/src/compilation-cache.h
index fe623dc79..6799b1cb9 100644
--- a/src/compilation-cache.h
+++ b/src/compilation-cache.h
@@ -114,14 +114,12 @@ class CompilationCacheEval: public CompilationSubCache {
       : CompilationSubCache(isolate, generations) { }
 
   MaybeHandle<SharedFunctionInfo> Lookup(Handle<String> source,
-                                         Handle<Context> context,
+                                         Handle<SharedFunctionInfo> outer_info,
                                          StrictMode strict_mode,
                                          int scope_position);
 
-  void Put(Handle<String> source,
-           Handle<Context> context,
-           Handle<SharedFunctionInfo> function_info,
-           int scope_position);
+  void Put(Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+           Handle<SharedFunctionInfo> function_info, int scope_position);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(CompilationCacheEval);
@@ -161,8 +159,8 @@ class CompilationCache {
   // given context.  Returns an empty handle if the cache doesn't
   // contain a script for the given source string.
   MaybeHandle<SharedFunctionInfo> LookupEval(
-      Handle<String> source, Handle<Context> context, StrictMode strict_mode,
-      int scope_position);
+      Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+      Handle<Context> context, StrictMode strict_mode, int scope_position);
 
   // Returns the regexp data associated with the given regexp if it
   // is in cache, otherwise an empty handle.
@@ -177,10 +175,9 @@ class CompilationCache {
 
   // Associate the (source, context->closure()->shared(), kind) triple
   // with the shared function info. This may overwrite an existing mapping.
-  void PutEval(Handle<String> source,
+  void PutEval(Handle<String> source, Handle<SharedFunctionInfo> outer_info,
                Handle<Context> context,
-               Handle<SharedFunctionInfo> function_info,
-               int scope_position);
+               Handle<SharedFunctionInfo> function_info, int scope_position);
 
   // Associate the (source, flags) pair to the given regexp data.
   // This may overwrite an existing mapping.
diff --git a/src/compiler.cc b/src/compiler.cc
index 7cd76ff2f..ea604c9b9 100644
--- a/src/compiler.cc
+++ b/src/compiler.cc
@@ -1084,11 +1084,9 @@ static Handle<SharedFunctionInfo> CompileToplevel(CompilationInfo* info) {
 
 
 MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
-    Handle<String> source,
-    Handle<Context> context,
-    StrictMode strict_mode,
-    ParseRestriction restriction,
-    int scope_position) {
+    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+    Handle<Context> context, StrictMode strict_mode,
+    ParseRestriction restriction, int scope_position) {
   Isolate* isolate = source->GetIsolate();
   int source_length = source->length();
   isolate->counters()->total_eval_size()->Increment(source_length);
@@ -1096,7 +1094,7 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
 
   CompilationCache* compilation_cache = isolate->compilation_cache();
   MaybeHandle<SharedFunctionInfo> maybe_shared_info =
-      compilation_cache->LookupEval(source, context, strict_mode,
+      compilation_cache->LookupEval(source, outer_info, context, strict_mode,
                                     scope_position);
   Handle<SharedFunctionInfo> shared_info;
 
@@ -1123,8 +1121,8 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
       // If caller is strict mode, the result must be in strict mode as well.
       DCHECK(strict_mode == SLOPPY || shared_info->strict_mode() == STRICT);
       if (!shared_info->dont_cache()) {
-        compilation_cache->PutEval(
-            source, context, shared_info, scope_position);
+        compilation_cache->PutEval(source, outer_info, context, shared_info,
+                                   scope_position);
       }
     }
   } else if (shared_info->ic_age() != isolate->heap()->global_ic_age()) {
diff --git a/src/compiler.h b/src/compiler.h
index 8c4177197..f950ef74c 100644
--- a/src/compiler.h
+++ b/src/compiler.h
@@ -682,11 +682,9 @@ class Compiler : public AllStatic {
 
   // Compile a String source within a context for eval.
   MUST_USE_RESULT static MaybeHandle<JSFunction> GetFunctionFromEval(
-      Handle<String> source,
-      Handle<Context> context,
-      StrictMode strict_mode,
-      ParseRestriction restriction,
-      int scope_position);
+      Handle<String> source, Handle<SharedFunctionInfo> outer_info,
+      Handle<Context> context, StrictMode strict_mode,
+      ParseRestriction restriction, int scope_position);
 
   // Compile a String source within a context.
   static Handle<SharedFunctionInfo> CompileScript(
diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index 03640780b..74fb0aedb 100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1265,12 +1265,14 @@ void AstGraphBuilder::VisitCall(Call* expr) {
 
     // Create node to ask for help resolving potential eval call. This will
     // provide a fully resolved callee and the corresponding receiver.
+    Node* function = GetFunctionClosure();
     Node* receiver = environment()->Lookup(info()->scope()->receiver());
     Node* strict = jsgraph()->Constant(strict_mode());
     Node* position = jsgraph()->Constant(info()->scope()->start_position());
     const Operator* op =
-        javascript()->Runtime(Runtime::kResolvePossiblyDirectEval, 5);
-    Node* pair = NewNode(op, callee, source, receiver, strict, position);
+        javascript()->Runtime(Runtime::kResolvePossiblyDirectEval, 6);
+    Node* pair =
+        NewNode(op, callee, source, function, receiver, strict, position);
     Node* new_callee = NewNode(common()->Projection(0), pair);
     Node* new_receiver = NewNode(common()->Projection(1), pair);
 
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 1cc646e14..dfe60fed6 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -1548,6 +1548,8 @@ void Heap::Scavenge() {
   LOG(isolate_, ResourceEvent("scavenge", "end"));
 
   gc_state_ = NOT_IN_GC;
+
+  gc_idle_time_handler_.NotifyScavenge();
 }
 
 
@@ -4257,25 +4259,29 @@ void Heap::MakeHeapIterable() {
 }
 
 
+void Heap::IdleMarkCompact(const char* message) {
+  bool uncommit = false;
+  if (gc_count_at_last_idle_gc_ == gc_count_) {
+    // No GC since the last full GC, the mutator is probably not active.
+    isolate_->compilation_cache()->Clear();
+    uncommit = true;
+  }
+  CollectAllGarbage(kReduceMemoryFootprintMask, message);
+  gc_idle_time_handler_.NotifyIdleMarkCompact();
+  gc_count_at_last_idle_gc_ = gc_count_;
+  if (uncommit) {
+    new_space_.Shrink();
+    UncommitFromSpace();
+  }
+}
+
+
 void Heap::AdvanceIdleIncrementalMarking(intptr_t step_size) {
   incremental_marking()->Step(step_size,
                               IncrementalMarking::NO_GC_VIA_STACK_GUARD, true);
 
   if (incremental_marking()->IsComplete()) {
-    bool uncommit = false;
-    if (gc_count_at_last_idle_gc_ == gc_count_) {
-      // No GC since the last full GC, the mutator is probably not active.
-      isolate_->compilation_cache()->Clear();
-      uncommit = true;
-    }
-    CollectAllGarbage(kReduceMemoryFootprintMask,
-                      "idle notification: finalize incremental");
-    gc_idle_time_handler_.NotifyIdleMarkCompact();
-    gc_count_at_last_idle_gc_ = gc_count_;
-    if (uncommit) {
-      new_space_.Shrink();
-      UncommitFromSpace();
-    }
+    IdleMarkCompact("idle notification: finalize incremental");
   }
 }
 
@@ -4333,11 +4339,14 @@ bool Heap::IdleNotification(int idle_time_in_ms) {
       break;
     case DO_FULL_GC: {
       HistogramTimerScope scope(isolate_->counters()->gc_context());
-      const char* message = contexts_disposed_
-                                ? "idle notification: contexts disposed"
-                                : "idle notification: finalize idle round";
-      CollectAllGarbage(kReduceMemoryFootprintMask, message);
-      gc_idle_time_handler_.NotifyIdleMarkCompact();
+      if (contexts_disposed_) {
+        CollectAllGarbage(kReduceMemoryFootprintMask,
+                          "idle notification: contexts disposed");
+        gc_idle_time_handler_.NotifyIdleMarkCompact();
+        gc_count_at_last_idle_gc_ = gc_count_;
+      } else {
+        IdleMarkCompact("idle notification: finalize idle round");
+      }
       break;
     }
     case DO_SCAVENGE:
diff --git a/src/heap/heap.h b/src/heap/heap.h
index 956b8595c..c9d0f3135 100644
--- a/src/heap/heap.h
+++ b/src/heap/heap.h
@@ -1926,6 +1926,8 @@ class Heap {
 
   void SelectScavengingVisitorsTable();
 
+  void IdleMarkCompact(const char* message);
+
   void AdvanceIdleIncrementalMarking(intptr_t step_size);
 
   bool WorthActivatingIncrementalMarking();
diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index a5065aa47..661d3013c 100644
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -2708,6 +2708,8 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
     __ push(Immediate(isolate()->factory()->undefined_value()));
   }
 
+  // Push the enclosing function.
+  __ push(Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
   // Push the receiver of the enclosing function.
   __ push(Operand(ebp, (2 + info_->scope()->num_parameters()) * kPointerSize));
   // Push the language mode.
@@ -2717,7 +2719,7 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ push(Immediate(Smi::FromInt(scope()->start_position())));
 
   // Do the runtime call.
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/json-parser.h b/src/json-parser.h
index d3148c9e2..29932492d 100644
--- a/src/json-parser.h
+++ b/src/json-parser.h
@@ -182,6 +182,9 @@ class JsonParser BASE_EMBEDDED {
  private:
   Zone* zone() { return &zone_; }
 
+  void CommitStateToJsonObject(Handle<JSObject> json_object, Handle<Map> map,
+                               ZoneList<Handle<Object> >* properties);
+
   Handle<String> source_;
   int source_length_;
   Handle<SeqOneByteString> seq_source_;
@@ -410,13 +413,7 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
         }
 
         // Commit the intermediate state to the object and stop transitioning.
-        JSObject::AllocateStorageForMap(json_object, map);
-        int length = properties.length();
-        for (int i = 0; i < length; i++) {
-          Handle<Object> value = properties[i];
-          FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
-          json_object->FastPropertyAtPut(index, *value);
-        }
+        CommitStateToJsonObject(json_object, map, &properties);
       } else {
         key = ParseJsonInternalizedString();
         if (key.is_null() || c0_ != ':') return ReportUnexpectedCharacter();
@@ -434,19 +431,50 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
 
     // If we transitioned until the very end, transition the map now.
     if (transitioning) {
-      JSObject::AllocateStorageForMap(json_object, map);
-      int length = properties.length();
-      for (int i = 0; i < length; i++) {
-        Handle<Object> value = properties[i];
-        FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
-        json_object->FastPropertyAtPut(index, *value);
-      }
+      CommitStateToJsonObject(json_object, map, &properties);
     }
   }
   AdvanceSkipWhitespace();
   return scope.CloseAndEscape(json_object);
 }
 
+
+template <bool seq_one_byte>
+void JsonParser<seq_one_byte>::CommitStateToJsonObject(
+    Handle<JSObject> json_object, Handle<Map> map,
+    ZoneList<Handle<Object> >* properties) {
+  JSObject::AllocateStorageForMap(json_object, map);
+  DCHECK(!json_object->map()->is_dictionary_map());
+
+  DisallowHeapAllocation no_gc;
+  Factory* factory = isolate()->factory();
+  // If the |json_object|'s map is exactly the same as |map| then the
+  // |properties| values correspond to the |map| and nothing more has to be
+  // done. But if the |json_object|'s map is different then we have to
+  // iterate descriptors to ensure that properties still correspond to the
+  // map.
+  bool slow_case = json_object->map() != *map;
+  DescriptorArray* descriptors = NULL;
+
+  int length = properties->length();
+  if (slow_case) {
+    descriptors = json_object->map()->instance_descriptors();
+    DCHECK(json_object->map()->NumberOfOwnDescriptors() == length);
+  }
+  for (int i = 0; i < length; i++) {
+    Handle<Object> value = (*properties)[i];
+    if (slow_case && value->IsMutableHeapNumber() &&
+        !descriptors->GetDetails(i).representation().IsDouble()) {
+      // Turn mutable heap numbers into immutable if the field representation
+      // is not double.
+      HeapNumber::cast(*value)->set_map(*factory->heap_number_map());
+    }
+    FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
+    json_object->FastPropertyAtPut(index, *value);
+  }
+}
+
+
 // Parse a JSON array. Position must be right at '['.
 template <bool seq_one_byte>
 Handle<Object> JsonParser<seq_one_byte>::ParseJsonArray() {
diff --git a/src/mips/full-codegen-mips.cc b/src/mips/full-codegen-mips.cc
index 568b8bd3c..1dbfe095b 100644
--- a/src/mips/full-codegen-mips.cc
+++ b/src/mips/full-codegen-mips.cc
@@ -2264,23 +2264,26 @@ void FullCodeGenerator::EmitCreateIteratorResult(bool done) {
   Label gc_required;
   Label allocated;
 
-  Handle<Map> map(isolate()->native_context()->iterator_result_map());
+  const int instance_size = 5 * kPointerSize;
+  DCHECK_EQ(isolate()->native_context()->iterator_result_map()->instance_size(),
+            instance_size);
 
-  __ Allocate(map->instance_size(), v0, a2, a3, &gc_required, TAG_OBJECT);
+  __ Allocate(instance_size, v0, a2, a3, &gc_required, TAG_OBJECT);
   __ jmp(&allocated);
 
   __ bind(&gc_required);
-  __ Push(Smi::FromInt(map->instance_size()));
+  __ Push(Smi::FromInt(instance_size));
   __ CallRuntime(Runtime::kAllocateInNewSpace, 1);
   __ lw(context_register(),
         MemOperand(fp, StandardFrameConstants::kContextOffset));
 
   __ bind(&allocated);
-  __ li(a1, Operand(map));
+  __ lw(a1, ContextOperand(cp, Context::GLOBAL_OBJECT_INDEX));
+  __ lw(a1, FieldMemOperand(a1, GlobalObject::kNativeContextOffset));
+  __ lw(a1, ContextOperand(a1, Context::ITERATOR_RESULT_MAP_INDEX));
   __ pop(a2);
   __ li(a3, Operand(isolate()->factory()->ToBoolean(done)));
   __ li(t0, Operand(isolate()->factory()->empty_fixed_array()));
-  DCHECK_EQ(map->instance_size(), 5 * kPointerSize);
   __ sw(a1, FieldMemOperand(v0, HeapObject::kMapOffset));
   __ sw(t0, FieldMemOperand(v0, JSObject::kPropertiesOffset));
   __ sw(t0, FieldMemOperand(v0, JSObject::kElementsOffset));
@@ -2769,13 +2772,16 @@ void FullCodeGenerator::EmitCall(Call* expr, CallICState::CallType call_type) {
 
 
 void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
-  // t2: copy of the first argument or undefined if it doesn't exist.
+  // t3: copy of the first argument or undefined if it doesn't exist.
   if (arg_count > 0) {
-    __ lw(t2, MemOperand(sp, arg_count * kPointerSize));
+    __ lw(t3, MemOperand(sp, arg_count * kPointerSize));
   } else {
-    __ LoadRoot(t2, Heap::kUndefinedValueRootIndex);
+    __ LoadRoot(t3, Heap::kUndefinedValueRootIndex);
   }
 
+  // t2: the receiver of the enclosing function.
+  __ lw(t2, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+
   // t1: the receiver of the enclosing function.
   int receiver_offset = 2 + info_->scope()->num_parameters();
   __ lw(t1, MemOperand(fp, receiver_offset * kPointerSize));
@@ -2787,8 +2793,9 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ li(a1, Operand(Smi::FromInt(scope()->start_position())));
 
   // Do the runtime call.
+  __ Push(t3);
   __ Push(t2, t1, t0, a1);
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/mips64/full-codegen-mips64.cc b/src/mips64/full-codegen-mips64.cc
index 5c26f1639..8f8c376db 100644
--- a/src/mips64/full-codegen-mips64.cc
+++ b/src/mips64/full-codegen-mips64.cc
@@ -2261,23 +2261,26 @@ void FullCodeGenerator::EmitCreateIteratorResult(bool done) {
   Label gc_required;
   Label allocated;
 
-  Handle<Map> map(isolate()->native_context()->iterator_result_map());
+  const int instance_size = 5 * kPointerSize;
+  DCHECK_EQ(isolate()->native_context()->iterator_result_map()->instance_size(),
+            instance_size);
 
-  __ Allocate(map->instance_size(), v0, a2, a3, &gc_required, TAG_OBJECT);
+  __ Allocate(instance_size, v0, a2, a3, &gc_required, TAG_OBJECT);
   __ jmp(&allocated);
 
   __ bind(&gc_required);
-  __ Push(Smi::FromInt(map->instance_size()));
+  __ Push(Smi::FromInt(instance_size));
   __ CallRuntime(Runtime::kAllocateInNewSpace, 1);
   __ ld(context_register(),
         MemOperand(fp, StandardFrameConstants::kContextOffset));
 
   __ bind(&allocated);
-  __ li(a1, Operand(map));
+  __ ld(a1, ContextOperand(cp, Context::GLOBAL_OBJECT_INDEX));
+  __ ld(a1, FieldMemOperand(a1, GlobalObject::kNativeContextOffset));
+  __ ld(a1, ContextOperand(a1, Context::ITERATOR_RESULT_MAP_INDEX));
   __ pop(a2);
   __ li(a3, Operand(isolate()->factory()->ToBoolean(done)));
   __ li(a4, Operand(isolate()->factory()->empty_fixed_array()));
-  DCHECK_EQ(map->instance_size(), 5 * kPointerSize);
   __ sd(a1, FieldMemOperand(v0, HeapObject::kMapOffset));
   __ sd(a4, FieldMemOperand(v0, JSObject::kPropertiesOffset));
   __ sd(a4, FieldMemOperand(v0, JSObject::kElementsOffset));
@@ -2769,13 +2772,16 @@ void FullCodeGenerator::EmitCall(Call* expr, CallICState::CallType call_type) {
 
 
 void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
-  // a6: copy of the first argument or undefined if it doesn't exist.
+  // a7: copy of the first argument or undefined if it doesn't exist.
   if (arg_count > 0) {
-    __ ld(a6, MemOperand(sp, arg_count * kPointerSize));
+    __ ld(a7, MemOperand(sp, arg_count * kPointerSize));
   } else {
-    __ LoadRoot(a6, Heap::kUndefinedValueRootIndex);
+    __ LoadRoot(a7, Heap::kUndefinedValueRootIndex);
   }
 
+  // a6: the receiver of the enclosing function.
+  __ ld(a6, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+
   // a5: the receiver of the enclosing function.
   int receiver_offset = 2 + info_->scope()->num_parameters();
   __ ld(a5, MemOperand(fp, receiver_offset * kPointerSize));
@@ -2787,8 +2793,9 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ li(a1, Operand(Smi::FromInt(scope()->start_position())));
 
   // Do the runtime call.
+  __ Push(a7);
   __ Push(a6, a5, a4, a1);
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/objects.cc b/src/objects.cc
index eed455409..39d3d7c35 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -14724,13 +14724,13 @@ Handle<Object> CompilationCacheTable::Lookup(Handle<String> src,
 }
 
 
-Handle<Object> CompilationCacheTable::LookupEval(Handle<String> src,
-                                                 Handle<Context> context,
-                                                 StrictMode strict_mode,
-                                                 int scope_position) {
+Handle<Object> CompilationCacheTable::LookupEval(
+    Handle<String> src, Handle<SharedFunctionInfo> outer_info,
+    StrictMode strict_mode, int scope_position) {
   Isolate* isolate = GetIsolate();
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
-  StringSharedKey key(src, shared, strict_mode, scope_position);
+  // Cache key is the tuple (source, outer shared function info, scope position)
+  // to unambiguously identify the context chain the cached eval code assumes.
+  StringSharedKey key(src, outer_info, strict_mode, scope_position);
   int entry = FindEntry(&key);
   if (entry == kNotFound) return isolate->factory()->undefined_value();
   return Handle<Object>(get(EntryToIndex(entry) + 1), isolate);
@@ -14767,11 +14767,10 @@ Handle<CompilationCacheTable> CompilationCacheTable::Put(
 
 Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
     Handle<CompilationCacheTable> cache, Handle<String> src,
-    Handle<Context> context, Handle<SharedFunctionInfo> value,
+    Handle<SharedFunctionInfo> outer_info, Handle<SharedFunctionInfo> value,
     int scope_position) {
   Isolate* isolate = cache->GetIsolate();
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
-  StringSharedKey key(src, shared, value->strict_mode(), scope_position);
+  StringSharedKey key(src, outer_info, value->strict_mode(), scope_position);
   cache = EnsureCapacity(cache, 1, &key);
   Handle<Object> k = key.AsHandle(isolate);
   int entry = cache->FindInsertionEntry(key.Hash());
diff --git a/src/objects.h b/src/objects.h
index e2321974d..33403501f 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -7863,15 +7863,16 @@ class CompilationCacheTable: public HashTable<CompilationCacheTable,
  public:
   // Find cached value for a string key, otherwise return null.
   Handle<Object> Lookup(Handle<String> src, Handle<Context> context);
-  Handle<Object> LookupEval(Handle<String> src, Handle<Context> context,
-                     StrictMode strict_mode, int scope_position);
+  Handle<Object> LookupEval(Handle<String> src,
+                            Handle<SharedFunctionInfo> shared,
+                            StrictMode strict_mode, int scope_position);
   Handle<Object> LookupRegExp(Handle<String> source, JSRegExp::Flags flags);
   static Handle<CompilationCacheTable> Put(
       Handle<CompilationCacheTable> cache, Handle<String> src,
       Handle<Context> context, Handle<Object> value);
   static Handle<CompilationCacheTable> PutEval(
       Handle<CompilationCacheTable> cache, Handle<String> src,
-      Handle<Context> context, Handle<SharedFunctionInfo> value,
+      Handle<SharedFunctionInfo> context, Handle<SharedFunctionInfo> value,
       int scope_position);
   static Handle<CompilationCacheTable> PutRegExp(
       Handle<CompilationCacheTable> cache, Handle<String> src,
diff --git a/src/runtime.cc b/src/runtime.cc
index 5209de468..cfef8c23b 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -7813,7 +7813,7 @@ RUNTIME_FUNCTION(Runtime_RemPiO2) {
   DCHECK(args.length() == 1);
   CONVERT_DOUBLE_ARG_CHECKED(x, 0);
   Factory* factory = isolate->factory();
-  double y[2];
+  double y[2] = {0.0, 0.0};
   int n = fdlibm::rempio2(x, y);
   Handle<FixedArray> array = factory->NewFixedArray(3);
   Handle<HeapNumber> y0 = factory->NewHeapNumber(y[0]);
@@ -9894,17 +9894,20 @@ RUNTIME_FUNCTION(Runtime_CompileString) {
   // Compile source string in the native context.
   ParseRestriction restriction = function_literal_only
       ? ONLY_SINGLE_FUNCTION_LITERAL : NO_PARSE_RESTRICTION;
+  Handle<SharedFunctionInfo> outer_info(context->closure()->shared(), isolate);
   Handle<JSFunction> fun;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, fun,
       Compiler::GetFunctionFromEval(
-          source, context, SLOPPY, restriction, RelocInfo::kNoPosition));
+          source, outer_info,
+          context, SLOPPY, restriction, RelocInfo::kNoPosition));
   return *fun;
 }
 
 
 static ObjectPair CompileGlobalEval(Isolate* isolate,
                                     Handle<String> source,
+                                    Handle<SharedFunctionInfo> outer_info,
                                     Handle<Object> receiver,
                                     StrictMode strict_mode,
                                     int scope_position) {
@@ -9931,7 +9934,8 @@ static ObjectPair CompileGlobalEval(Isolate* isolate,
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, compiled,
       Compiler::GetFunctionFromEval(
-          source, context, strict_mode, restriction, scope_position),
+          source, outer_info,
+          context, strict_mode, restriction, scope_position),
       MakePair(isolate->heap()->exception(), NULL));
   return MakePair(*compiled, *receiver);
 }
@@ -9939,7 +9943,7 @@ static ObjectPair CompileGlobalEval(Isolate* isolate,
 
 RUNTIME_FUNCTION_RETURN_PAIR(Runtime_ResolvePossiblyDirectEval) {
   HandleScope scope(isolate);
-  DCHECK(args.length() == 5);
+  DCHECK(args.length() == 6);
 
   Handle<Object> callee = args.at<Object>(0);
 
@@ -9953,15 +9957,18 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_ResolvePossiblyDirectEval) {
     return MakePair(*callee, isolate->heap()->undefined_value());
   }
 
-  DCHECK(args[3]->IsSmi());
-  DCHECK(args.smi_at(3) == SLOPPY || args.smi_at(3) == STRICT);
-  StrictMode strict_mode = static_cast<StrictMode>(args.smi_at(3));
   DCHECK(args[4]->IsSmi());
+  DCHECK(args.smi_at(4) == SLOPPY || args.smi_at(4) == STRICT);
+  StrictMode strict_mode = static_cast<StrictMode>(args.smi_at(4));
+  DCHECK(args[5]->IsSmi());
+  Handle<SharedFunctionInfo> outer_info(args.at<JSFunction>(2)->shared(),
+                                        isolate);
   return CompileGlobalEval(isolate,
                            args.at<String>(1),
-                           args.at<Object>(2),
+                           outer_info,
+                           args.at<Object>(3),
                            strict_mode,
-                           args.smi_at(4));
+                           args.smi_at(5));
 }
 
 
@@ -12968,6 +12975,7 @@ MUST_USE_RESULT static MaybeHandle<JSObject> MaterializeArgumentsObject(
 
 // Compile and evaluate source for the given context.
 static MaybeHandle<Object> DebugEvaluate(Isolate* isolate,
+                                         Handle<SharedFunctionInfo> outer_info,
                                          Handle<Context> context,
                                          Handle<Object> context_extension,
                                          Handle<Object> receiver,
@@ -12982,6 +12990,7 @@ static MaybeHandle<Object> DebugEvaluate(Isolate* isolate,
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, eval_fun,
       Compiler::GetFunctionFromEval(source,
+                                    outer_info,
                                     context,
                                     SLOPPY,
                                     NO_PARSE_RESTRICTION,
@@ -13047,6 +13056,7 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
   JavaScriptFrame* frame = it.frame();
   FrameInspector frame_inspector(frame, inlined_jsframe_index, isolate);
   Handle<JSFunction> function(JSFunction::cast(frame_inspector.GetFunction()));
+  Handle<SharedFunctionInfo> outer_info(function->shared());
 
   // Traverse the saved contexts chain to find the active context for the
   // selected frame.
@@ -13078,7 +13088,8 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
-      DebugEvaluate(isolate, context, context_extension, receiver, source));
+      DebugEvaluate(isolate, outer_info,
+                    context, context_extension, receiver, source));
 
   // Write back potential changes to materialized stack locals to the stack.
   UpdateStackLocalsFromMaterializedObject(
@@ -13118,10 +13129,12 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluateGlobal) {
   // debugger was invoked.
   Handle<Context> context = isolate->native_context();
   Handle<JSObject> receiver(context->global_proxy());
+  Handle<SharedFunctionInfo> outer_info(context->closure()->shared(), isolate);
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
-      DebugEvaluate(isolate, context, context_extension, receiver, source));
+      DebugEvaluate(isolate, outer_info,
+                    context, context_extension, receiver, source));
   return *result;
 }
 
diff --git a/src/runtime.h b/src/runtime.h
index 38e1469b3..e63cd909c 100644
--- a/src/runtime.h
+++ b/src/runtime.h
@@ -507,7 +507,7 @@ namespace internal {
   F(InitializeLegacyConstLookupSlot, 3, 1)                   \
                                                              \
   /* Eval */                                                 \
-  F(ResolvePossiblyDirectEval, 5, 2)                         \
+  F(ResolvePossiblyDirectEval, 6, 2)                         \
                                                              \
   /* Maths */                                                \
   F(MathPowSlow, 2, 1)                                       \
diff --git a/src/version.cc b/src/version.cc
index dc44f9297..75846224d 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     29
 #define BUILD_NUMBER      88
-#define PATCH_LEVEL       10
+#define PATCH_LEVEL       15
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0
diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index 1c7f0952f..0f787b28e 100644
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -2703,6 +2703,9 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
     __ PushRoot(Heap::kUndefinedValueRootIndex);
   }
 
+  // Push the enclosing function.
+  __ Push(Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
+
   // Push the receiver of the enclosing function and do runtime call.
   StackArgumentsAccessor args(rbp, info_->scope()->num_parameters());
   __ Push(args.GetReceiverOperand());
@@ -2714,7 +2717,7 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ Push(Smi::FromInt(scope()->start_position()));
 
   // Do the runtime call.
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/src/x87/full-codegen-x87.cc b/src/x87/full-codegen-x87.cc
index 58328e06f..c159edded 100644
--- a/src/x87/full-codegen-x87.cc
+++ b/src/x87/full-codegen-x87.cc
@@ -2191,22 +2191,25 @@ void FullCodeGenerator::EmitCreateIteratorResult(bool done) {
   Label gc_required;
   Label allocated;
 
-  Handle<Map> map(isolate()->native_context()->iterator_result_map());
+  const int instance_size = 5 * kPointerSize;
+  DCHECK_EQ(isolate()->native_context()->iterator_result_map()->instance_size(),
+            instance_size);
 
-  __ Allocate(map->instance_size(), eax, ecx, edx, &gc_required, TAG_OBJECT);
+  __ Allocate(instance_size, eax, ecx, edx, &gc_required, TAG_OBJECT);
   __ jmp(&allocated);
 
   __ bind(&gc_required);
-  __ Push(Smi::FromInt(map->instance_size()));
+  __ Push(Smi::FromInt(instance_size));
   __ CallRuntime(Runtime::kAllocateInNewSpace, 1);
   __ mov(context_register(),
          Operand(ebp, StandardFrameConstants::kContextOffset));
 
   __ bind(&allocated);
-  __ mov(ebx, map);
+  __ mov(ebx, Operand(esi, Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX)));
+  __ mov(ebx, FieldOperand(ebx, GlobalObject::kNativeContextOffset));
+  __ mov(ebx, ContextOperand(ebx, Context::ITERATOR_RESULT_MAP_INDEX));
   __ pop(ecx);
   __ mov(edx, isolate()->factory()->ToBoolean(done));
-  DCHECK_EQ(map->instance_size(), 5 * kPointerSize);
   __ mov(FieldOperand(eax, HeapObject::kMapOffset), ebx);
   __ mov(FieldOperand(eax, JSObject::kPropertiesOffset),
          isolate()->factory()->empty_fixed_array());
@@ -2695,6 +2698,8 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
     __ push(Immediate(isolate()->factory()->undefined_value()));
   }
 
+  // Push the enclosing function.
+  __ push(Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
   // Push the receiver of the enclosing function.
   __ push(Operand(ebp, (2 + info_->scope()->num_parameters()) * kPointerSize));
   // Push the language mode.
@@ -2704,7 +2709,7 @@ void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   __ push(Immediate(Smi::FromInt(scope()->start_position())));
 
   // Do the runtime call.
-  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 5);
+  __ CallRuntime(Runtime::kResolvePossiblyDirectEval, 6);
 }
 
 
diff --git a/test/mjsunit/regress/regress-crbug-423687.js b/test/mjsunit/regress/regress-crbug-423687.js
new file mode 100644
index 000000000..60003527e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-423687.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var json = '{"a":{"c":2.1,"d":0},"b":{"c":7,"1024":8}}';
+var data = JSON.parse(json);
+
+data.b.c++;
diff --git a/test/mjsunit/sin-cos.js b/test/mjsunit/sin-cos.js
index 71fae2056..fb6f858c7 100644
--- a/test/mjsunit/sin-cos.js
+++ b/test/mjsunit/sin-cos.js
@@ -227,6 +227,8 @@ assertEquals(-two_32, Math.tan(-two_32));
 assertEquals(0.8211418015898941, Math.tan(11/16));
 assertEquals(-0.8211418015898941, Math.tan(-11/16));
 assertEquals(0.41421356237309503, Math.tan(Math.PI / 8));
+// crbug/427468
+assertEquals(0.7993357819992383, Math.tan(0.6743358));
 
 // Tests for Math.sin.
 assertEquals(0.479425538604203, Math.sin(0.5));
diff --git a/third_party/fdlibm/fdlibm.js b/third_party/fdlibm/fdlibm.js
index 08c6f5e72..7fd9adf36 100644
--- a/third_party/fdlibm/fdlibm.js
+++ b/third_party/fdlibm/fdlibm.js
@@ -267,7 +267,7 @@ function KernelTan(x, y, returnTan) {
       }
     }
   }
-  if (ix >= 0x3fe59429) {  // |x| > .6744
+  if (ix >= 0x3fe59428) {  // |x| > .6744
     if (x < 0) {
       x = -x;
       y = -y;
@@ -362,9 +362,9 @@ function MathTan(x) {
 // ES6 draft 09-27-13, section 20.2.2.20.
 // Math.log1p
 //
-// Method :                  
-//   1. Argument Reduction: find k and f such that 
-//                      1+x = 2^k * (1+f), 
+// Method :
+//   1. Argument Reduction: find k and f such that
+//                      1+x = 2^k * (1+f),
 //         where  sqrt(2)/2 < 1+f < sqrt(2) .
 //
 //      Note. If k=0, then f=x is exact. However, if k!=0, then f
@@ -378,8 +378,8 @@ function MathTan(x) {
 //      Let s = f/(2+f) ; based on log(1+f) = log(1+s) - log(1-s)
 //            = 2s + 2/3 s**3 + 2/5 s**5 + .....,
 //            = 2s + s*R
-//      We use a special Reme algorithm on [0,0.1716] to generate 
-//      a polynomial of degree 14 to approximate R The maximum error 
+//      We use a special Reme algorithm on [0,0.1716] to generate
+//      a polynomial of degree 14 to approximate R The maximum error
 //      of this polynomial approximation is bounded by 2**-58.45. In
 //      other words,
 //                      2      4      6      8      10      12      14
@@ -387,21 +387,21 @@ function MathTan(x) {
 //      (the values of Lp1 to Lp7 are listed in the program)
 //      and
 //          |      2          14          |     -58.45
-//          | Lp1*s +...+Lp7*s    -  R(z) | <= 2 
+//          | Lp1*s +...+Lp7*s    -  R(z) | <= 2
 //          |                             |
 //      Note that 2s = f - s*f = f - hfsq + s*hfsq, where hfsq = f*f/2.
 //      In order to guarantee error in log below 1ulp, we compute log
 //      by
 //              log1p(f) = f - (hfsq - s*(hfsq+R)).
 //
-//      3. Finally, log1p(x) = k*ln2 + log1p(f).  
+//      3. Finally, log1p(x) = k*ln2 + log1p(f).
 //                           = k*ln2_hi+(f-(hfsq-(s*(hfsq+R)+k*ln2_lo)))
-//         Here ln2 is split into two floating point number: 
+//         Here ln2 is split into two floating point number:
 //                      ln2_hi + ln2_lo,
 //         where n*ln2_hi is always exact for |n| < 2000.
 //
 // Special cases:
-//      log1p(x) is NaN with signal if x < -1 (including -INF) ; 
+//      log1p(x) is NaN with signal if x < -1 (including -INF) ;
 //      log1p(+INF) is +INF; log1p(-1) is -INF with signal;
 //      log1p(NaN) is that NaN with no signal.
 //
@@ -506,7 +506,7 @@ function MathLog1p(x) {
     }
   }
 
-  var s = f / (2 + f); 
+  var s = f / (2 + f);
   var z = s * s;
   var R = z * (KLOG1P(0) + z * (KLOG1P(1) + z *
               (KLOG1P(2) + z * (KLOG1P(3) + z *
@@ -526,9 +526,9 @@ function MathLog1p(x) {
 //   1. Argument reduction:
 //      Given x, find r and integer k such that
 //
-//               x = k*ln2 + r,  |r| <= 0.5*ln2 ~ 0.34658  
+//               x = k*ln2 + r,  |r| <= 0.5*ln2 ~ 0.34658
 //
-//      Here a correction term c will be computed to compensate 
+//      Here a correction term c will be computed to compensate
 //      the error in r when rounded to a floating-point number.
 //
 //   2. Approximating expm1(r) by a special rational function on
@@ -541,9 +541,9 @@ function MathLog1p(x) {
 //          R1(r**2) = 6/r *((exp(r)+1)/(exp(r)-1) - 2/r)
 //                   = 6/r * ( 1 + 2.0*(1/(exp(r)-1) - 1/r))
 //                   = 1 - r^2/60 + r^4/2520 - r^6/100800 + ...
-//      We use a special Remes algorithm on [0,0.347] to generate 
-//      a polynomial of degree 5 in r*r to approximate R1. The 
-//      maximum error of this polynomial approximation is bounded 
+//      We use a special Remes algorithm on [0,0.347] to generate
+//      a polynomial of degree 5 in r*r to approximate R1. The
+//      maximum error of this polynomial approximation is bounded
 //      by 2**-61. In other words,
 //          R1(z) ~ 1.0 + Q1*z + Q2*z**2 + Q3*z**3 + Q4*z**4 + Q5*z**5
 //      where   Q1  =  -1.6666666666666567384E-2,
@@ -554,21 +554,21 @@ function MathLog1p(x) {
 //      (where z=r*r, and the values of Q1 to Q5 are listed below)
 //      with error bounded by
 //          |                  5           |     -61
-//          | 1.0+Q1*z+...+Q5*z   -  R1(z) | <= 2 
+//          | 1.0+Q1*z+...+Q5*z   -  R1(z) | <= 2
 //          |                              |
 //
-//      expm1(r) = exp(r)-1 is then computed by the following 
-//      specific way which minimize the accumulation rounding error: 
+//      expm1(r) = exp(r)-1 is then computed by the following
+//      specific way which minimize the accumulation rounding error:
 //                             2     3
 //                            r     r    [ 3 - (R1 + R1*r/2)  ]
 //            expm1(r) = r + --- + --- * [--------------------]
 //                            2     2    [ 6 - r*(3 - R1*r/2) ]
 //
 //      To compensate the error in the argument reduction, we use
-//              expm1(r+c) = expm1(r) + c + expm1(r)*c 
-//                         ~ expm1(r) + c + r*c 
+//              expm1(r+c) = expm1(r) + c + expm1(r)*c
+//                         ~ expm1(r) + c + r*c
 //      Thus c+r*c will be added in as the correction terms for
-//      expm1(r+c). Now rearrange the term to avoid optimization 
+//      expm1(r+c). Now rearrange the term to avoid optimization
 //      screw up:
 //                      (      2                                    2 )
 //                      ({  ( r    [ R1 -  (3 - R1*r/2) ]  )  }    r  )
@@ -592,7 +592,7 @@ function MathLog1p(x) {
 //                     else          return  1.0+2.0*(r-E);
 //        (v)   if (k<-2||k>56) return 2^k(1-(E-r)) - 1 (or exp(x)-1)
 //        (vi)  if k <= 20, return 2^k((1-2^-k)-(E-r)), else
-//        (vii) return 2^k(1-((E+2^-k)-r)) 
+//        (vii) return 2^k(1-((E+2^-k)-r))
 //
 // Special cases:
 //      expm1(INF) is INF, expm1(NaN) is NaN;
@@ -604,7 +604,7 @@ function MathLog1p(x) {
 //      1 ulp (unit in the last place).
 //
 // Misc. info.
-//      For IEEE double 
+//      For IEEE double
 //          if x > 7.09782712893383973096e+02 then expm1(x) overflow
 //
 const KEXPM1_OVERFLOW = kMath[45];
@@ -621,7 +621,7 @@ function MathExpm1(x) {
   var k;
   var t;
   var c;
-    
+
   var hx = %_DoubleHi(x);
   var xsb = hx & 0x80000000;     // Sign bit of x
   var y = (xsb === 0) ? x : -x;  // y = |x|
@@ -722,7 +722,7 @@ function MathExpm1(x) {
 //          0        <= x <= 22     :  sinh(x) := --------------, E=expm1(x)
 //                                                      2
 //
-//          22       <= x <= lnovft :  sinh(x) := exp(x)/2 
+//          22       <= x <= lnovft :  sinh(x) := exp(x)/2
 //          lnovft   <= x <= ln2ovft:  sinh(x) := exp(x/2)/2 * exp(x/2)
 //          ln2ovft  <  x           :  sinh(x) := x*shuge (overflow)
 //
@@ -763,18 +763,18 @@ function MathSinh(x) {
 
 // ES6 draft 09-27-13, section 20.2.2.12.
 // Math.cosh
-// Method : 
+// Method :
 // mathematically cosh(x) if defined to be (exp(x)+exp(-x))/2
-//      1. Replace x by |x| (cosh(x) = cosh(-x)). 
+//      1. Replace x by |x| (cosh(x) = cosh(-x)).
 //      2.
-//                                                      [ exp(x) - 1 ]^2 
+//                                                      [ exp(x) - 1 ]^2
 //          0        <= x <= ln2/2  :  cosh(x) := 1 + -------------------
 //                                                         2*exp(x)
 //
 //                                                 exp(x) + 1/exp(x)
 //          ln2/2    <= x <= 22     :  cosh(x) := -------------------
 //                                                        2
-//          22       <= x <= lnovft :  cosh(x) := exp(x)/2 
+//          22       <= x <= lnovft :  cosh(x) := exp(x)/2
 //          lnovft   <= x <= ln2ovft:  cosh(x) := exp(x/2)/2 * exp(x/2)
 //          ln2ovft  <  x           :  cosh(x) := huge*huge (overflow)
 //