Bug: v8:7790
Change-Id: Ia5903364a774bd49db1a646b3066b9972deac725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3074465
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76119}

Bug: v8:7790
Change-Id: I299678102254ffb7d68be3d5cad11b4a4161492f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3068947
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76118}

Based on a CL by mvstanton@.

Bug: v8:7790,v8:12030,v8:12031,v8:12041
Change-Id: I58b75bd96c724a99133bec7d3bd6cf4e0c9be6d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3059683Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76055}

Bug: v8:7790
Change-Id: I0d875d4a350d4e101534d82129cd7ef90f342738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3008639Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75933}

.. and explicitly mark behavior through tags/naming conventions:

 // This method is never called when concurrent inlining is enabled.
 void SerializeFoo(NotConcurrentInliningTag);

 // This method is thread-safe and may be called at any time.
 void CacheBar();

It turns out that all our remaining SerializeFoo methods are already
either of the former or latter category and thus do not block removal
of the serialization phase for concurrent inlining.

Bug: v8:7790
Change-Id: If8f3bc2e407bc2824f83bfcd1f520f3b14dc58ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3026709
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75804}

This wraps up the transition away from kSerialized ref kinds.

Since JSFunctionRef is a complex type, we don't attempt full
consistency on the background thread. Instead, we serialize functions
on the background in a partially-racy manner, in which consistency
between different JSFunction fields is *not* guaranteed. Consistency
is later verified through a new compilation dependency kind during
finalization.

Bug: v8:7790, v8:12004
Change-Id: Ic2b78af9c9fe183c8769d323132bb304b151dc75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968404
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75789}

Bug: v8:7790
Change-Id: I7a658215ba2dbb12e90b651bce7ff08109b03b8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2987831
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75703}

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I26faa6bc1934662c81ae127dee64bddffa428de9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874165Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74371}

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I36c07f69378f3a630462c216ef5da284cfd3972f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871449
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74367}

The compiler is only interested in the contents if it contains a
FeedbackVector. If one is discovered, it is serialized, and we
ensure we'll either return it or nothing if the contents of
the cell changed on the main thread.

FeedbackCells can be reset if the bytecode for the associated
function is flushed. We have guarantees only for functions we
choose to inline that this doesn't happen (by holding a strong
handle to the SharedFunctionInfo).

Bug: v8:7790
Change-Id: I9ecff3f4aef39169d84501feae9e47f2d118054e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434324
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72260}

This is the 2nd step in series of CLs to move the SharedFunctionInfo
class to kNeverSerialized and make it concurrently accessible from
the background thread. This CL:
* Changes optimization of GetTemplateObject in JSCreateLowering to
  only perform the optimization of a template object exists in the
  SharedFunctionInfo[Ref], but skips the optimization if one is
  missing instead of allocating a new one on demand.

Bug: v8:7790
Change-Id: Ic37d8333676e54b3f8d69416480df12bd90723ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463229
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71189}

This is the second reland of
https://chromium-review.googlesource.com/c/v8/v8/+/2487122 , this time
without RuntimeCallStats in the tests.

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I782df6e032ff8191082b425e68d68b69cef0a560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527092
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71077}

This reverts commit 30ca51ec.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71052}

TBR=marja@chromium.org,neis@chromium.org

Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71058}

This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71052}

This reverts commit 0147db5a.

Reason for revert: Data races: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34056

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70988}

TBR=marja@chromium.org,mvstanton@chromium.org,neis@chromium.org

Change-Id: Ib5ddb919ae569fe5ddf266d986f1c8bc0fe9621a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520908Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70992}

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70988}

This is the first step in a series of CLs. The goal is to make
super property access faster.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit?usp=sharing

This CL:
- Add bytecode LdaNamedPropertyFromSuper
- IGNITION_HANDLER just calls Runtime::LoadFromSuper
- JSGenericLowering::LowerJSLoadNamedFromSuper just replaces the node
with a runtime call to Runtime::LoadFromSuper


Bug: v8:9237
Change-Id: Id28e935294c5068dd6c54e6b860a77d61517fff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2327912
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69604}

HasProperty and InstanceOf now both have a feedback vector input, and
collect feedback in generic lowering.

CreateClosure loads the feedback cell (in nci mode) instead of embedding
a heap constant.

Bug: v8:8888
Change-Id: Id479cda344684aeb5054f687b087c4fedeac05d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282530Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68711}

This is a reland of 8748613f, fixing
an issue accessing binary op's BinaryOperationHints.

Original change's description:
> [compiler] Hook in binary op builtins with feedback in generic lowering
>
> If --turbo-nci is enabled, use binary op builtins with feedback
> collection during generic lowering.
>
> Bug: v8:8888
> Change-Id: I307dc742488982bdc68006be5bcd1da8e68768f5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228614
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68227}

Bug: v8:8888,chromium:1092553
Change-Id: I1356659d65a5e46bc57bb6c0ebe2e9e86cb8be81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2237128
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68288}

This reverts commit 8748613f.

Reason for revert: MSAN failures (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/32760?)

Original change's description:
> [compiler] Hook in binary op builtins with feedback in generic lowering
> 
> If --turbo-nci is enabled, use binary op builtins with feedback
> collection during generic lowering.
> 
> Bug: v8:8888
> Change-Id: I307dc742488982bdc68006be5bcd1da8e68768f5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228614
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68227}

TBR=neis@chromium.org,jgruber@chromium.org

Change-Id: I635b1a5a28b25ce29e4f8bc23eb52841885b0cdf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235535Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68229}

If --turbo-nci is enabled, use binary op builtins with feedback
collection during generic lowering.

Bug: v8:8888
Change-Id: I307dc742488982bdc68006be5bcd1da8e68768f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228614
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68227}

If --turbo-nci is enabled, use compare op builtins with feedback
collection during generic lowering.

Bug: v8:8888
Change-Id: I886020e2ee280f65388d9987c70958546f99e0f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215821Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68100}

In typed lowering, if our target is a CheckClosure or a CreateClosure
node, we can extract a SharedFunctionInfo from the opcodes
parameters in order to make calls a bit more efficient.

Change-Id: Ib06dea2e8505bfeb984c4cefd5ad1bed0defa5f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2087402
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66683}

Almost everywhere, we use the ProcessedFeedback abstraction to
query feedback in the compiler. The remaining exception is in handling
RegExp, Object and Array literals. By bringing this in line with
other feedback queries, we no longer need to serialize all feedback
vector slots (possibly wasteful of memory), and offer a uniform way
to pick up feedback everywhere.

Bug: v8:7790, v8:9396
Change-Id: Ice42587595fe30bebfbd7835d2b2e9e49601c92e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807358
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64016}

Bug: v8:7790
Change-Id: I798555bb6fbbee2ce2a3dc4bb22a84ff881792f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1784294Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63589}

This is a reland of ab089c78, after
making a flaky test more robust.

Original change's description:
> [turbofan] Prepare for moving part of CreateGraph into the background
>
> - Pass Refs, not Handles, to graph builder, and drop bytecode array argument
>   (get it from SFI instead).
> - Add some fields to FeedbackVectorRef that are needed to avoid heap access
>   in BytecodeGraphBuilderPhase.
> - Rename FeedbackVectorRef's SerializeSlots to Serialize, since it's more
>   than just the feedback slots.
> - Rearrange the last steps in PipelineCompilationJob::PrepareJobImpl such
>   that CreateGraph is last.
>
> Bug: v8:7790
> Change-Id: I4b17790d1d74da41ba63ee68e3a33968662fc398
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781682
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63515}

Bug: v8:7790
Change-Id: Ia6f4c1ebd82dea93c14437514d0e25b730523f75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781694Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63545}

This is a reland of d82600ec

Added missing builtin serializations that were breaking Clusterfuzz,
layout tests and Speedometer.

Original change's description:
> [turbofan] Serialize missing objects
>
> Added a few objects to the standard objects list, as well as specific
> builtins when the corresponding runtime calls are detected in the
> serializer. Now JSHeapCopyReducer is needed only when concurrent
> inlining is disabled.
>
> Bug: v8:7790
> Change-Id: I91d933611b0352df8ede4fded665f13669591fef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63509}

Bug: v8:7790, chromium:1000136
Change-Id: I4775014bfe8100fb76f60e4088f1bdf2a8da64a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781681
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63525}

This reverts commit ab089c78.

Reason for revert: Breaking GC stress (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/27523)

Original change's description:
> [turbofan] Prepare for moving part of CreateGraph into the background
> 
> - Pass Refs, not Handles, to graph builder, and drop bytecode array argument
>   (get it from SFI instead).
> - Add some fields to FeedbackVectorRef that are needed to avoid heap access
>   in BytecodeGraphBuilderPhase.
> - Rename FeedbackVectorRef's SerializeSlots to Serialize, since it's more
>   than just the feedback slots.
> - Rearrange the last steps in PipelineCompilationJob::PrepareJobImpl such
>   that CreateGraph is last.
> 
> Bug: v8:7790
> Change-Id: I4b17790d1d74da41ba63ee68e3a33968662fc398
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781682
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63515}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I4dc95907657597d12cbe1ce6a8ebb694ef44e915
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781687Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63517}

- Pass Refs, not Handles, to graph builder, and drop bytecode array argument
  (get it from SFI instead).
- Add some fields to FeedbackVectorRef that are needed to avoid heap access
  in BytecodeGraphBuilderPhase.
- Rename FeedbackVectorRef's SerializeSlots to Serialize, since it's more
  than just the feedback slots.
- Rearrange the last steps in PipelineCompilationJob::PrepareJobImpl such
  that CreateGraph is last.

Bug: v8:7790
Change-Id: I4b17790d1d74da41ba63ee68e3a33968662fc398
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781682Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63515}

This reverts commit d82600ec.

Reason for revert: Blocking the roll, see https://ci.chromium.org/p/chromium/builders/try/linux-rel/181725

Original change's description:
> [turbofan] Serialize missing objects
> 
> Added a few objects to the standard objects list, as well as specific
> builtins when the corresponding runtime calls are detected in the
> serializer. Now JSHeapCopyReducer is needed only when concurrent
> inlining is disabled.
> 
> Bug: v8:7790
> Change-Id: I91d933611b0352df8ede4fded665f13669591fef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63509}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I5eb8a8371994822debb852fc2a090ba585826d4a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1782157Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63514}

Added a few objects to the standard objects list, as well as specific
builtins when the corresponding runtime calls are detected in the
serializer. Now JSHeapCopyReducer is needed only when concurrent
inlining is disabled.

Bug: v8:7790
Change-Id: I91d933611b0352df8ede4fded665f13669591fef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63509}

- Add serialization for CallNoFeedback, which was missing.
- Extend serialization for CallJSRuntime.
- Serialize for calls to higher-order Array builtins.
- Serialize for calls to Function#apply and Function#call.
- Serialize for calls to Reflect.apply and Reflect.construct.
- Serialize for calls to Promise constructor.
- Fix ConvertReceiverMode in serialization for CallProperty.

Bug: v8:7790
Change-Id: I4bba6f45f9b7948ed2ba9c70bd423a23ec29ecf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763530Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63497}

Bug: chromium:998802
Change-Id: I243c00b367ffd1c5c54ca6930681b1b1d3317b26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773273
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63492}

This is a reland of 8ff8ddba

Original change's description:
> [turbofan] Further brokerize BytecodeGraphBuilder
> 
> Replace all usages of VectorSlotPair with FeedbackSource.
> 
> Bug: v8:7790
> Change-Id: I0ac6e9cd8f5730154cc1842e267ca1ebfdebc874
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763536
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63378}

Bug: v8:7790
Change-Id: I54fbf4433a65681780fda4ded09ec2d145d36ec1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768361Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63391}

This reverts commit 8ff8ddba.

Reason for revert: Causes failures on GC Stress and TSan:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/24138
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/27969

Original change's description:
> [turbofan] Further brokerize BytecodeGraphBuilder
> 
> Replace all usages of VectorSlotPair with FeedbackSource.
> 
> Bug: v8:7790
> Change-Id: I0ac6e9cd8f5730154cc1842e267ca1ebfdebc874
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763536
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63378}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: Ieb6fb24dd0626fd9eb2183844614ac5b3c8084e8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1769287Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63387}

Replace all usages of VectorSlotPair with FeedbackSource.

Bug: v8:7790
Change-Id: I0ac6e9cd8f5730154cc1842e267ca1ebfdebc874
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763536
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63378}

Also: add hint for "prototype" property. This makes us not miss
the ObjectCreate map in any of our tests.

Bug: v8:7790
Change-Id: Icc9f91ebaf466a1cdfba27526335b930c744b9c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762519
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63336}

Bug: v8:7790
Change-Id: I02de7cb5b89a20a4eb10407cb1ff56ed3ece098f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762520
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63322}

Bug: v8:7790
Change-Id: I6705e5399ad37201b89d5d6d5174138b22401ca1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762518Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63315}

The BytecodeGraphBuilder still looks at the heap. This CL mostly
eliminates heap lookups for:

* CreateArrayLiteral
* CreateObjectLiteral
* CreateRegExpLiteral

What remains is the lookup embedded in the creation of a VectorSlotPair,
which will be addressed in a subsequent change.

Bug: v8:7790
Change-Id: I5e4167f5542b84ed3684ad61f3dd1ef8ad84c96b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1745482
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63173}