This should speed up trace generation for cpu profile as it eliminates
creation of temporary std::string objects.

Review-Url: https://codereview.chromium.org/2555043003
Cr-Commit-Position: refs/heads/master@{#41736}

Original commit message:
[wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.

Some instructions in WebAssembly trap for some inputs, which means that the
execution is terminated and (at least at the moment) a JavaScript exception is
thrown. Examples for traps are out-of-bounds memory accesses, or integer
divisions by zero.

Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
constant), in addition to the trap condition itself. Additionally, each
WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
number of inputs is linear to the number of trap checks in the function.
Especially for functions with high numbers of trap checks we observe a
significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
a TrapIf common operator only a single node is necessary per trap check, in
addition to the trap condition. Also the nodes which are shared between trap
checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
speedup of 30-50% on average.

This CL only implements TrapIf and TrapUnless on x64. The implementation is also
hidden behind the --wasm-trap-if flag.

Please take a special look at how the source position is transfered from the
instruction selector to the code generator, and at the context that is used for
the runtime call.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2571813002
Cr-Commit-Position: refs/heads/master@{#41735}

Original CL description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Review-Url: https://codereview.chromium.org/2547483002

BUG=v8:5589
TBR=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2577063002
Cr-Commit-Position: refs/heads/master@{#41734}

.. by using variadic templates in CodeAssembler and RawMachineAssembler.

BUG=

Review-Url: https://codereview.chromium.org/2580823002
Cr-Commit-Position: refs/heads/master@{#41733}

Revert of [wasm] Make WasmRunner the central test structure (patchset #5 id:80001 of https://codereview.chromium.org/2551043002/ )

Reason for revert:
Win64 dbg failures

Original issue's description:
> [wasm] Make WasmRunner the central test structure
>
> The WasmRunner now always holds a TestingModule, and allows to add
> several functions to it. The prepares a change to always run wasm code
> with a full module behind it, removing the special handling for "no wasm
> instance" at runtime (http://crrev.com/2551053002).
> This CL here also templatizes the WasmRunner such that the Call method must
> be called with the same signature specified for the WasmRunner. This
> already catched several mismatches there.
>
> R=titzer@chromium.org, ahaas@chromium.org
> BUG=v8:5620
>
> Review-Url: https://codereview.chromium.org/2551043002
> Cr-Commit-Position: refs/heads/master@{#41728}
> Committed: https://chromium.googlesource.com/v8/v8/+/2ff59062314e9b86bcc28dfaa53cedf2d98e3a13

TBR=ahaas@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2583543002
Cr-Commit-Position: refs/heads/master@{#41732}

Instead of unconditionally setting maybe_assigned for parameters, treat
parameters like other variables except that at the end we set maybe_assigned if
the function has a sloppy arguments object.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2578103002
Cr-Commit-Position: refs/heads/master@{#41731}

This will be used in PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2581503003
Cr-Commit-Position: refs/heads/master@{#41730}

R=jochen@chromium.org, hpayer@chromium.org, verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2584563002
Cr-Commit-Position: refs/heads/master@{#41729}

The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41728}

This was kind of hard to read due to the nesting. Refactor it using short-circuit
a bit more and add some comments to each bit.

Review-Url: https://codereview.chromium.org/2573283003
Cr-Commit-Position: refs/heads/master@{#41727}

R=neis@chromium.org
BUG=v8:5743

Review-Url: https://codereview.chromium.org/2577043004
Cr-Commit-Position: refs/heads/master@{#41726}

If an accessor property is non-configurable, one should not be able
to re-declare it as a function. This specifically applies to special properties like window.location.

BUG=chromium:670596

Review-Url: https://codereview.chromium.org/2582493002
Cr-Commit-Position: refs/heads/master@{#41725}

Similar to object grouping, we cannot trace through blink (and back to V8) after
making weak roots strong because phantom callbacks have already been scheduled
and the handles been zapped.

This is a short-term solution (mimicing what object grouping currently does). It
is not correct in general because we should fully process the subgraph that was
discovered by making some of the weak roots strong.  In long term we need  a
separate handle type on the API level for traced references that have their
handles zapped at a different stage.

Reproduction:
- Initial marking is done, i.e., both marking deques are empty.
- We make weak roots needed for regular finalizers strong.
- We collect phantom callback data and zap handles that are not reachable so far.
- Through new roots we discover wrappables on the blink side that would also keep
  objects that were already scheduled for phantom callbacks alive.
- Since the handle was already zapped we crash during dereferencing.

BUG=chromium:668060,chromium:468240

Review-Url: https://codereview.chromium.org/2580813002
Cr-Commit-Position: refs/heads/master@{#41724}

If the eval contains a let, we need to know whether an inner function
refers to the variable to be able to decide its context allocation
status.

The added test needs https://codereview.chromium.org/2435023002/ too
in order to pass.

BUG=v8:5736

Review-Url: https://codereview.chromium.org/2574753002
Cr-Commit-Position: refs/heads/master@{#41723}

BUG=

Review-Url: https://codereview.chromium.org/2580533002
Cr-Commit-Position: refs/heads/master@{#41722}

The error reported by the graph verifier looks like:

#
# Fatal error in ../src/compiler/machine-graph-verifier.cc, line 638
# TypeError: node #54:ChangeInt32ToInt64 uses node #53:ChangeUint32ToUint64 which doesn't have an int32-compatible representation.
#
# Specify option --csa-trap-on-node=test,54 for debugging.
#

BUG=

Review-Url: https://codereview.chromium.org/2574353002
Cr-Commit-Position: refs/heads/master@{#41721}

Some instructions in WebAssembly trap for some inputs, which means that the
execution is terminated and (at least at the moment) a JavaScript exception is
thrown. Examples for traps are out-of-bounds memory accesses, or integer
divisions by zero.

Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
constant), in addition to the trap condition itself. Additionally, each
WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
number of inputs is linear to the number of trap checks in the function.
Especially for functions with high numbers of trap checks we observe a
significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
a TrapIf common operator only a single node is necessary per trap check, in
addition to the trap condition. Also the nodes which are shared between trap
checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
speedup of 30-50% on average.

This CL only implements TrapIf and TrapUnless on x64. The implementation is also
hidden behind the --wasm-trap-if flag.

Please take a special look at how the source position is transfered from the
instruction selector to the code generator, and at the context that is used for
the runtime call.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2562393002
Cr-Commit-Position: refs/heads/master@{#41720}

Adds assignment tracking to the bytecode analysis pass, and updates
bytecode graph builder to only create LoopExitValues for assigned
values.

Review-Url: https://codereview.chromium.org/2558093005
Cr-Commit-Position: refs/heads/master@{#41719}

Review-Url: https://codereview.chromium.org/2579743002
Cr-Commit-Position: refs/heads/master@{#41718}

MIPS[64]R6 supports only fusion multiply-accumulate instructions, and using
these causes failures of several tests that expect exact floating-point
results. Therefore we disable fusion multiply-accumulate in both emitted and
compiled code on R6.

TEST=cctest/test-run-machops/RunFloat64MulAndFloat64Add1,mjsunit/es6/math-expm1.js
mjsunit/es6/math-fround.js,mjsunit/compiler/multiply-add.js

BUG=

Review-Url: https://codereview.chromium.org/2569683002
Cr-Commit-Position: refs/heads/master@{#41717}

This splits branch ref creation and landing. The ref now directly uses
heads (without pending) and for landing we use depot_tools.

For simplicity, the check for existing tags is removed, as it now
is very unlikely to happen again without gnumbd.

BUG=chromium:674448
NOTRY=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2584523002
Cr-Commit-Position: refs/heads/master@{#41716}

[stubs] Enable machine graph verification for CodeStubAssembler and friends by default in debug mode.

BUG=

Review-Url: https://codereview.chromium.org/2570213002
Cr-Commit-Position: refs/heads/master@{#41715}

Allocate the registers used as arguments to a call on-demand after visiting the
argument (or reciever). This means that the visited expression can use registers
that would otherwise have been allocated for arguments which haven't been
visited yet.

The reason for doing this is to avoid keeping things live in registers
unecessarily for chained function calls, which avoids a memory leak for
functions which chain a large number of calls with large temporary arguments /
recievers.

BUG=chromium:672027

Review-Url: https://codereview.chromium.org/2557173004
Cr-Commit-Position: refs/heads/master@{#41714}

This fixes a corner case where the {FastCloneShallowArrayStub} was used
for literals that are backed by a double backing store and would exceed
limits for new-space allocations on 32-bit architectures. The stub in
question does not support such literals, callers must use the runtime.
Note that this fix is for Ignition as well as FullCodeGenerator.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-672792
BUG=chromium:672792

Review-Url: https://codereview.chromium.org/2570843002
Cr-Commit-Position: refs/heads/master@{#41713}

Reland of Whitespace change to test gnumbd shutdown - CQ (patchset #1 id:1 of https://codereview.chromium.org/2583443002/ )

Reason for revert:
Test reland

Original issue's description:
> Revert of Whitespace change to test gnumbd shutdown - CQ (patchset #1 id:1 of https://codereview.chromium.org/2579733002/ )
>
> Reason for revert:
> Test revert
>
> Original issue's description:
> > Whitespace change to test gnumbd shutdown - CQ
> >
> > BUG=chromium:674448
> > NOTRY=true
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > TBR=tandrii@chromium.org
> >
> > Review-Url: https://codereview.chromium.org/2579733002
> > Cr-Commit-Position: refs/heads/master@{#41710}
> > Committed: https://chromium.googlesource.com/v8/v8/+/47f8979d12543f814eddad990544447d4f95053c
>
> TBR=tandrii@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:674448
>
> Review-Url: https://codereview.chromium.org/2583443002
> Cr-Commit-Position: refs/heads/master@{#41711}
> Committed: https://chromium.googlesource.com/v8/v8/+/4619fbe42a91de67abe4f794cf67274035776d84

TBR=tandrii@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:674448

Review-Url: https://codereview.chromium.org/2580623003
Cr-Commit-Position: refs/heads/master@{#41712}

Revert of Whitespace change to test gnumbd shutdown - CQ (patchset #1 id:1 of https://codereview.chromium.org/2579733002/ )

Reason for revert:
Test revert

Original issue's description:
> Whitespace change to test gnumbd shutdown - CQ
>
> BUG=chromium:674448
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> TBR=tandrii@chromium.org
>
> Review-Url: https://codereview.chromium.org/2579733002
> Cr-Commit-Position: refs/heads/master@{#41710}
> Committed: https://chromium.googlesource.com/v8/v8/+/47f8979d12543f814eddad990544447d4f95053c

TBR=tandrii@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:674448

Review-Url: https://codereview.chromium.org/2583443002
Cr-Commit-Position: refs/heads/master@{#41711}

BUG=chromium:674448
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2579733002
Cr-Commit-Position: refs/heads/master@{#41710}

BUG=chromium:674448
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=tandrii@chromium.org

Review-Url: https://codereview.chromium.org/2580743004 .
Cr-Commit-Position: refs/heads/master@{#41709}

Cr-Commit-Position: refs/heads/master@{#41708}

TBR=machenbach@chromium.org
NOTRY=True
NOPERSUBMIT=True
BUG=chromium:674448

Review-Url: https://codereview.chromium.org/2582443003
Cr-Commit-Position: refs/heads/master@{#41707}

Templatizes the AccumulatorUsage and OperandType for BytecodeNode creation and
BytecodeRegisterOptimizer::PrepareForBytecode. This allows the compiler to
statically know whether the bytecode being created accesses the accumulator
and what operand types need scaling, avoiding runtime checks in the code.

Also removes BytecodeNode::set_bytecode methods.

Review-Url: https://codereview.chromium.org/2542903003
Cr-Commit-Position: refs/heads/master@{#41706}

ES6 requires the compile method to return this:
www.ecma-international.org/ecma-262/6.0/#sec-regexp.prototype.compile

BUG=v8:5722,chromium:585775

Review-Url: https://codereview.chromium.org/2577653002
Cr-Commit-Position: refs/heads/master@{#41705}

Determine if the scope of the function to be serialized includes asm-
wasm, and if so, bypass serialization, since we do not support it in
that scenario.

In this change, we do so regardless of whether the asm-wasm path was
successful. This is so we keep the design simple, since the guidance
to developers, moving forward, is to use wasm.

BUG=643595

Review-Url: https://codereview.chromium.org/2573193002
Cr-Commit-Position: refs/heads/master@{#41704}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d16d922..d4ca00b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b7b743b..ab73453

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/6b7c8d5..286099f

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2578883002
Cr-Commit-Position: refs/heads/master@{#41703}

Review-Url: https://codereview.chromium.org/2581443002
Cr-Commit-Position: refs/heads/master@{#41702}

Promise catch prediction no longer has to be threaded through the
parser since the code using %catch has been moved to TF codestubs.

This is currently dead code.

BUG=v8:5343,v8:5741

Review-Url: https://codereview.chromium.org/2575133002
Cr-Commit-Position: refs/heads/master@{#41701}

Printing an asm.js success message and timings is useful,
but also non-deterministic. Making the message stable unless a flag is passed.
This will avoid making it a hassle in the future to create LayoutTests
that use asm.js and verify console output.

BUG=v8:4203
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2574273002
Cr-Commit-Position: refs/heads/master@{#41700}

This CL moves even more limits to wasm-limits.h and enforces limits for
types, functions, parameter counts, return counts, local counts, imports,
globals, and exports.

R=clemensh@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2574133002
Cr-Commit-Position: refs/heads/master@{#41699}

Avoid needless resizing of the StateValueList's fields vector by
reserving its (already known) size.

Review-Url: https://codereview.chromium.org/2572683005
Cr-Commit-Position: refs/heads/master@{#41698}

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2578563002
Cr-Commit-Position: refs/heads/master@{#41697}