BUG=v8:4698
LOG=N
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1842763002

Cr-Commit-Position: refs/heads/master@{#35132}

Int64Mul is lowered to a new turbofan operator, Int32MulPair. The new
operator takes 4 inputs an generates 2 outputs. The inputs are the low
word of the left input, high word of the left input, the low word of the
right input, and high word of the right input. The ouputs are the low
and high word of the result of the multiplication.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1807273002

Cr-Commit-Position: refs/heads/master@{#35131}

Port d4a391bb

Add SmiTag()/smiUntag() calls to make values on stack GC-safe.

Original commit message:
Use macro instructions for min, max ops to get the same functionality on
pre-r6 and r6 targets.

BUG=chromium:598651
LOG=N

Review URL: https://codereview.chromium.org/1842833002

Cr-Commit-Position: refs/heads/master@{#35130}

  The CL #34967 (https://codereview.chromium.org/1804243003) and CL #35045 (https://codereview.chromium.org/1825333004)
  exposed one hidden bug in x87 turbofan code generation for Float32ToFloat64.

  This CL fixed this bug.

BUG=

Review URL: https://codereview.chromium.org/1847493002

Cr-Commit-Position: refs/heads/master@{#35129}

Reference build:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/7641

BUG=v8:4680
LOG=N
TBR=titzer@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1841963002

Cr-Commit-Position: refs/heads/master@{#35128}

Debugger fetches the return value of a function when we break at return.
Interpreter holds the return value in accumulator. This is not stored in a
specified location on stack and hence it is not possible to look it up from
stack similar to full-codegen or optimized frames. This cl adds support to
store the value of accumulator on debug breaks. The value of accumulator is
passed to the runtime function and is then stored in thread local data.

Also changes full-codegen implementation to match that of ignition.
The return value from full-codegen is also stored in thread local data.
The return value is fetched directly thread local data instead of
finding it by iterating over frames.

BUG=v8:4280, v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1842683002

Cr-Commit-Position: refs/heads/master@{#35127}

The new implementation deals with cycles in the TF graph in two steps:
1) The lowering of phis is delayed to avoid cyclic dependencies.
2) The replacement nodes of phis are created already when the phi is
   pushed onto the stack so that other nodes can use these replacements
   for their lowering.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1844553002

Cr-Commit-Position: refs/heads/master@{#35126}

Context is always available through deopt data, so there should be
no need to store the context back to the frame every time. (Turbofan
already does not store back to the frame.)

Review URL: https://codereview.chromium.org/1845553002

Cr-Commit-Position: refs/heads/master@{#35125}

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1837173002

Cr-Commit-Position: refs/heads/master@{#35124}

This CL introduces static variables and global lock for writing to the
dump files, so that multiple web workers do not run into trouble.

Review URL: https://codereview.chromium.org/1839133002

Cr-Commit-Position: refs/heads/master@{#35123}

Remove the duplicate if_join label (thanks C++ for not even emitting a
warning about this).

R=mtrofin@chromium.org

Review URL: https://codereview.chromium.org/1837393003

Cr-Commit-Position: refs/heads/master@{#35122}

The CodeGenerator sequence for Mod64/ModU64 is incorrectly using
32-bit operations.  Fix Mod64/ModU64 to use 64-bit divides to calculate
the remainder.

Fix disassembly for DLR, which was reading the wrong bits for the two
register operands.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1839813006

Cr-Commit-Position: refs/heads/master@{#35121}

R=littledan@chromium.org
BUG=v8:4602
LOG=y

Review URL: https://codereview.chromium.org/1838393002

Cr-Commit-Position: refs/heads/master@{#35120}

Fix bug in simulator which incorrectly interpreted the operands
for SQEBR (Float32 sqrt) as 64-bit doubles.  Add missing
disassembler case for SQEBR as well.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1837263003

Cr-Commit-Position: refs/heads/master@{#35119}

This patch adds fast paths for @@replace and @@split that call into
the old, side-effect free (and faster) versions of those builtin
operations when possible (roughly, when the receiver is a RegExp
and the 'exec' method is untampered). Also add some micro-optimizations
that further improve performance.

Taken altogether, this takes us from a ~70% regression on the Octane
RegExp benchmark to a ~9% regression.

The test262.status lines for RegExps has been reorganized to make it
clearer the status of individual tests. More work will likely be
required to increase spec compliance before the --harmony-regexp-exec
flag is shipped; some of that work is happening on the spec side.

BUG=v8:4602
LOG=y

Review URL: https://codereview.chromium.org/1836123002

Cr-Commit-Position: refs/heads/master@{#35118}

This method returns contextDebugId for function. We can't use context_data from FunctionMirror.prototype.script because it can be incorrect when compilation cache is used and one script object was used for JSFunctions in different contexts.

BUG=chromium:595206
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1840713002

Cr-Commit-Position: refs/heads/master@{#35117}

We'll require the abstract code (as well as the offset) when we do full backtraces.

R=bradnelson@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/1838933002

Cr-Commit-Position: refs/heads/master@{#35116}

wasm_to_js and js_to_wasm both derive from wasm, which was confusing because is_wasm wasn't true for them and that made WasmFrame::cast awkward. Make them derive from StubFrame instead.

R=bradnelson@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/1839843002

Cr-Commit-Position: refs/heads/master@{#35115}

AArch64 kernels older than 3.18 presented a different cpuinfo format
than what V8 expects. Most of V8's logic still works, but it misreads
the "CPU architecture" field.

BUG=

Review URL: https://codereview.chromium.org/1841733002

Cr-Commit-Position: refs/heads/master@{#35114}

This avoids redundant casts, loss of precision, and potential overflows.

BUG=chromium:597310
LOG=NO

Review URL: https://codereview.chromium.org/1841043002

Cr-Commit-Position: refs/heads/master@{#35113}

Updates the prologue_offset value in LCodeGen::GeneratePrologue after
generating ahi/aghi.
prologue_offset is used in FindCodeAgeSequence. Failing to update
prologue_offset will result in failing to correctly identify the code
aging sequence (young).

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1843673002

Cr-Commit-Position: refs/heads/master@{#35112}

This fixes available_in_free_list counter.

BUG=

Review URL: https://codereview.chromium.org/1840083002

Cr-Commit-Position: refs/heads/master@{#35111}

The CodeGenerator sequence for kS390_Div64 was incorrectly defaulting
to the 32-bit divide sequence.  That case has been fixed to use the
proper 64-bit divide (DSGR).

Fix bug in DLGR simulation where the register number was being used as
operands instead of the values in those registers.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1844563002

Cr-Commit-Position: refs/heads/master@{#35110}

BUG=

Review URL: https://codereview.chromium.org/1841713002

Cr-Commit-Position: refs/heads/master@{#35109}

BUG=

Review URL: https://codereview.chromium.org/1839003003

Cr-Commit-Position: refs/heads/master@{#35108}

BUG=

Review URL: https://codereview.chromium.org/1836013004

Cr-Commit-Position: refs/heads/master@{#35107}

Fix bug in simulator which incorrectly interpreted the operands
for CEBR (Float32 compare) as 64-bit doubles.  Add missing
disassembler case for CEBR as well.

R=jyan@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1844473002

Cr-Commit-Position: refs/heads/master@{#35106}

Uploading chromium CLs requires hooks to be run now,
what the auto-roller doesn't do.

TBR=hablich@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1843593002

Cr-Commit-Position: refs/heads/master@{#35105}

Now instead of saving all event details in the ring buffer,
we save only the bytes and duration.

This reduces the GCTracer size from 20K to 3K and simplifies code.

BUG=chromium:597310
LOG=NO

Review URL: https://codereview.chromium.org/1830723004

Cr-Commit-Position: refs/heads/master@{#35104}

Loop analysis results in smaller graphs (fewer phis), thus faster
compilation time and better code.

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1836223002

Cr-Commit-Position: refs/heads/master@{#35103}

I can't express my disbelief when I saw it getting a raw context
object from the runtime. Luckily this is not used anywhere.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1844543002

Cr-Commit-Position: refs/heads/master@{#35102}

This fixes another bug in Array.prototype.sort (when the array is not a
JSArray and there is a proxy on the prototype chain).

R=cbruni@chromium.org
BUG=chromium:596866
LOG=n

Review URL: https://codereview.chromium.org/1842563004

Cr-Commit-Position: refs/heads/master@{#35101}

BUG=

Review URL: https://codereview.chromium.org/1839993002

Cr-Commit-Position: refs/heads/master@{#35100}

R=jochen@chromium.org
BUG=v8:4361
LOG=N

Review URL: https://codereview.chromium.org/1819313002

Cr-Commit-Position: refs/heads/master@{#35099}

[es6] Add a flag to the Isolate that defines whether ES2015 tail call elimination is enabled or not.

Thus DevTools will be able to disable tail call elimination dynamically upon user's choice.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1837513002

Cr-Commit-Position: refs/heads/master@{#35098}

If we don't write fillers, we crash during PagedSpace verification when we try
to iterate over dead memory (unused folded allocation slots).

BUG=v8:4871,chromium:580959
LOG=N

Review URL: https://codereview.chromium.org/1837163002

Cr-Commit-Position: refs/heads/master@{#35097}

    In JavaScript code and stubs, JSSP mirrors the CSP but may be unaligned.
    But in WASM code only CSP is used, like native code, and it must be
    aligned.
    Calls into WASM from JS need to carefully align the C stack
    pointer (csp) and restore the previous JSSP, while calls from WASM
    to JS need to compute a new JSSP and restore their CSP after the
    call.

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1811283003

Cr-Commit-Position: refs/heads/master@{#35096}

BUG=

Review URL: https://codereview.chromium.org/1836213002

Cr-Commit-Position: refs/heads/master@{#35095}

Fix and re-enable the flexible representation for Math.floor (which is used to
implement Math.ceil) and Math.round, which allows Math.floor and Math.round to
return double results instead of int32, and therefore allows values outside
the int32 range, especially -0 is now a valid result, which doesn't deopt.

Also port this feature to x64 and ia32 when the CPU supports the SSE4.1
extension.

This addresses all the known deoptimization loops related to Math.round
in the Kraken benchmark suite, and seems to also address most of the
deoptimization loops related to Math.floor in the Oort Online benchmark.

Drive-by-fix: Import the regression tests for the broken HMathFloorOfDiv
optimization that caused the initial revert of the feature (for arm64 only
back then).

BUG=chromium:476477,v8:2890,v8:4059
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1841513003

Cr-Commit-Position: refs/heads/master@{#35094}

BUG=
NOTRY=true

Review URL: https://codereview.chromium.org/1842523004

Cr-Commit-Position: refs/heads/master@{#35093}