Depends on https://codereview.chromium.org/1413023002/

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1414713002

Cr-Commit-Position: refs/heads/master@{#31363}

The dispatcher failed to MISS properly when configured as a monomorphic
keyed string store, causing a crash.

BUG=v8:4495
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1415533003

Cr-Commit-Position: refs/heads/master@{#31362}

Cr-Commit-Position: refs/heads/master@{#31361}

The test suite is ran in 60% of the bots anyway and the
step is very short. For swarming, it's better to run this
together in one step as each step triggers a different bot.

BUG=chromium:535160
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413023002

Cr-Commit-Position: refs/heads/master@{#31360}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1411143002

Cr-Commit-Position: refs/heads/master@{#31359}

Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
that supports a fast path for small integers. Everything else is still
handled in the runtime.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412963002

Cr-Commit-Position: refs/heads/master@{#31358}

[IC] Ensure we don't transition receivers when there's a data property in the hidden prototype chain.

BUG=chromium:542647
R=cbruni@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1406873002

Cr-Commit-Position: refs/heads/master@{#31357}

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410353002

Cr-Commit-Position: refs/heads/master@{#31356}

This removes all locally constructed SimplifiedOperatorBuilder instances
and uses the one passed along the JSGraph. It ensures that the correct
zone is used to allocate operators, no matter where the reducer is used.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410003002

Cr-Commit-Position: refs/heads/master@{#31355}

The typer can infer true/false for ObjectIsSmi if the argument has a
fixed/known representation (i.e. is either known to be smi or heap
object).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1412673003

Cr-Commit-Position: refs/heads/master@{#31354}

This introduces an explicit lazy bailout. It is wrapped in the call
node, mostly because the lazy deoptimization processing is married
to the call processing in the instruction selector and the code generator.

It is still a terrible hack.

R=bmeurer@chromium.org,mstarzinger@chromium.org
BUG=chromium:543994,v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1412443003

Cr-Commit-Position: refs/heads/master@{#31353}

Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31352}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1406293003

Cr-Commit-Position: refs/heads/master@{#31351}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1411023002

Cr-Commit-Position: refs/heads/master@{#31350}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1411743003

Cr-Commit-Position: refs/heads/master@{#31349}

BUG=v8:4406
LOG=N

Review URL: https://codereview.chromium.org/1406353003

Cr-Commit-Position: refs/heads/master@{#31348}

Removes a branch that checks for a condition that has been checked on dominators of the branch.

This introduces a new reducer that propagates the list of checked conditions (and their boolean values) through the control flow graph. If it encounters a branch checking a condition with a known value, the branch is eliminated.

The analysis relies on loops being reducible: if a condition has been checked on all paths to loop entry, then it is checked in the loop (regardless what of the conditions checked inside the loop).

The implementation is fairly naive and could be improved:

- all the operation on the condition lists could be made allocation-free when revisited.

- we could try to use a map structure rather than a linked list (to make
lookups faster).

- the merging of control flow could be changed to take into account
  conditions from non-dominating paths (as long as all paths check
  the condition).

Review URL: https://codereview.chromium.org/1376293005

Cr-Commit-Position: refs/heads/master@{#31347}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1409143002

Cr-Commit-Position: refs/heads/master@{#31346}

Adds support for creating RegExp literals and adds some tests. Adds the
CreateRegExpLiteral bytecode.

BUG=v8:4280
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410853002

Cr-Commit-Position: refs/heads/master@{#31345}

BUG=

Review URL: https://codereview.chromium.org/1411713004

Cr-Commit-Position: refs/heads/master@{#31344}

Adds support for local context loads and stores. Also adds support for
creation of new block contexts (e.g., for let variables) and initializing
const / let variables with the hole appropriately.

Also adds some checks to ensure BytecodeArrayBuilder::context_count is set
appropriately and fixes tests to do so.

Adds the bytecode StaContextSlot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1403943004

Cr-Commit-Position: refs/heads/master@{#31343}

Adds basic support for iterating interpreter stack frames for GC. Currently
InterpreterStackFrames are treated just like JavaScriptStackFrames since the
JavaScriptFrame::IterateExpressions() will correctly iterate over all the
local / temp interpeter Registers, and will iterate over the
interpreter_entry_trampoline pc address. There is no need to explicitly
iterate over the BytecodeArray object since that is held in a machine
register in the bytecode handler which is marked as kMachTaggedAny by
TurboFan, and so will get iterated appropriately when iterating the
bytecode handler stub's stack frame.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1407513003

Cr-Commit-Position: refs/heads/master@{#31342}

Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset #3 id:100001 of https://codereview.chromium.org/1396333010/ )

Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}

Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}

Adds the bytecode StaGlobalStrict and replaces StaGlobal with StaGlobalSloppy.

BUG=v8:4280
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1406183002

Cr-Commit-Position: refs/heads/master@{#31339}

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1410793002

Cr-Commit-Position: refs/heads/master@{#31338}

BUG=

Review URL: https://codereview.chromium.org/1406173002

Cr-Commit-Position: refs/heads/master@{#31337}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1409113002

Cr-Commit-Position: refs/heads/master@{#31336}

Contributed by Raymond Toy: http://rtoy.github.io/fdlibm-js/

R=jkummerow@chromium.org
BUG=v8:3495
LOG=N

Review URL: https://codereview.chromium.org/1407213002

Cr-Commit-Position: refs/heads/master@{#31335}

This fixes the lifetime of nodes created by JSGlobalSpecialization that
contain a simplified operator. In the case where this reducer runs as
part of the inliner, the SimplifiedOperatorBuilder was instantiated with
the wrong zone. This led to use-after-free of simplified operators.

To avoid such situations in the future, we decided to move this operator
builder into the JSGraph and make the situation uniform with all other
operator builders.

R=bmeurer@chromium.org
BUG=chromium:543528
LOG=n

Review URL: https://codereview.chromium.org/1409993002

Cr-Commit-Position: refs/heads/master@{#31334}

To be useful for narrowing down bugs, --hydrogen-filter shouldn't prevent any
inlining that the function(s) being allowed to get optimized want(s) to do.

Free bonus content in this CL: support FLAG_stop_at in lithium-codegen-arm64,
copied from full-codegen-arm64.

Review URL: https://codereview.chromium.org/1407043004

Cr-Commit-Position: refs/heads/master@{#31333}

Revert of "[heap] Divide available memory upon compaction tasks" (patchset #2 id:20001 of https://codereview.chromium.org/1399403002/ )

Reason for revert:
Failing: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/2115

Original issue's description:
> Reland of "[heap] Divide available memory upon compaction tasks"
>
> This reverts commit ec1046f9.
>
> Original message:
>
> [heap] Divide available memory upon compaction tasks
> - Fairly (round-robin) divide available memory upon compaction tasks.
> - Ensure an upper limit (of memory) since dividing is O(n) for n free-space
>   nodes.
> - Refill from free lists managed by sweeper once a compaction space becomes
>   empty.
>
> Assumption for dividing memory: Memory in the free lists is sparse upon starting
> compaction (which means that only few nodes are available), except for memory
> reducer GCs, which happen in idle time though (so it's less of a problem).
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/a805be73f6f97645450124f75c0f7417ec7b3e70
> Cr-Commit-Position: refs/heads/master@{#31329}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1412643002

Cr-Commit-Position: refs/heads/master@{#31332}

R=cbruni@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411653002

Cr-Commit-Position: refs/heads/master@{#31331}

R=rossberg@chromium.org
BUG=v8:4471
LOG=N

Review URL: https://codereview.chromium.org/1410753002

Cr-Commit-Position: refs/heads/master@{#31330}

This reverts commit ec1046f9.

Original message:

[heap] Divide available memory upon compaction tasks
- Fairly (round-robin) divide available memory upon compaction tasks.
- Ensure an upper limit (of memory) since dividing is O(n) for n free-space
  nodes.
- Refill from free lists managed by sweeper once a compaction space becomes
  empty.

Assumption for dividing memory: Memory in the free lists is sparse upon starting
compaction (which means that only few nodes are available), except for memory
reducer GCs, which happen in idle time though (so it's less of a problem).

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1399403002

Cr-Commit-Position: refs/heads/master@{#31329}

NOTRY=true

Review URL: https://codereview.chromium.org/1413563002

Cr-Commit-Position: refs/heads/master@{#31328}

Review URL: https://codereview.chromium.org/1407883003

Cr-Commit-Position: refs/heads/master@{#31327}

The stub is used for Turbofan's fast path allocation.

Review URL: https://codereview.chromium.org/1404773002

Cr-Commit-Position: refs/heads/master@{#31326}

Revert of VectorICs: turn on vectors for STORE and KEYED_STORE ics. (patchset #1 id:1 of https://codereview.chromium.org/1396523005/ )

Reason for revert:
We harvested enough information now about the windows crash. We'll investigate that and reland when fixed.

Original issue's description:
> VectorICs: turn on vectors for STORE and KEYED_STORE ics.
>
> R=jkummerow@chromium.org
> BUG=
>
> Committed: https://crrev.com/52225f39df578e77b4804506ca4bc15e096f5cab
> Cr-Commit-Position: refs/heads/master@{#31252}
>
> Committed: https://crrev.com/31487015de401892b4d12b5faef0c47c201308da
> Cr-Commit-Position: refs/heads/master@{#31305}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1406163002

Cr-Commit-Position: refs/heads/master@{#31325}

BUG=v8:4495
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1410723002

Cr-Commit-Position: refs/heads/master@{#31324}