This ports the platform-specific SubStringStub to TurboFan.

It also contains a minor bug-fix for the case when the requested substring
length equals the subject string length, but the start index is not equal to 0.
The old stub implementation returned the subject string, while the new
implementation calls into runtime, which finally results in a thrown exception.

BUG=v8:5415

Committed: https://crrev.com/49be31921536716706a6790fbbf9c346b975af16
Review-Url: https://codereview.chromium.org/2355793003
Cr-Original-Commit-Position: refs/heads/master@{#39653}
Cr-Commit-Position: refs/heads/master@{#39851}

This patch simplifies code for speeding up marking and
removes write barrier counter.

The step size is now computed based in two parts:
- bytes to mark in order to keep up with allocation,
- bytes to mark in order to make progress.

BUG=chromium:616434, chromium:646139, chromium:644819
LOG=NO

Review-Url: https://codereview.chromium.org/2359903002
Cr-Commit-Position: refs/heads/master@{#39827}

Revert of [stubs] Port SubStringStub to TurboFan (patchset #8 id:140001 of https://codereview.chromium.org/2355793003/ )

Reason for revert:
Speculative revert because of stability problems

Original issue's description:
> [stubs] Port SubStringStub to TurboFan
>
> This ports the platform-specific SubStringStub to TurboFan.
>
> It also contains a minor bug-fix for the case when the requested substring
> length equals the subject string length, but the start index is not equal to 0.
> The old stub implementation returned the subject string, while the new
> implementation calls into runtime, which finally results in a thrown exception.
>
> BUG=v8:5415
>
> Committed: https://crrev.com/49be31921536716706a6790fbbf9c346b975af16
> Cr-Commit-Position: refs/heads/master@{#39653}

TBR=ishell@chromium.org,bmeurer@chromium.org,jgruber@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5415, chromium:649967
NOPRESUBMIT=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2365413002
Cr-Commit-Position: refs/heads/master@{#39737}

According to new store IC calling convention the value, slot and vector are passed
on the stack and there's no need in trying to preserve values or respective registers
in store handlers.

Nice bonus: we also don't need virtual registers anymore.

BUG=v8:5407

Review-Url: https://codereview.chromium.org/2357323003
Cr-Commit-Position: refs/heads/master@{#39672}

This ports the platform-specific SubStringStub to TurboFan.

It also contains a minor bug-fix for the case when the requested substring
length equals the subject string length, but the start index is not equal to 0.
The old stub implementation returned the subject string, while the new
implementation calls into runtime, which finally results in a thrown exception.

BUG=v8:5415

Review-Url: https://codereview.chromium.org/2355793003
Cr-Commit-Position: refs/heads/master@{#39653}

This cleanup is necessary to make HCallWithDescriptor support passing arguments on the stack.

BUG=v8:5407

Review-Url: https://codereview.chromium.org/2352163004
Cr-Commit-Position: refs/heads/master@{#39590}

BUG=

Review-Url: https://codereview.chromium.org/2357563002
Cr-Commit-Position: refs/heads/master@{#39542}

This CL also cleans up related interface descriptors:
1) unused StoreTransitionDescriptor is removed and VectorStoreTransitionDescriptor is
renamed to StoreTransitionDescriptor.
2) on ia32/x87 architectures slot and vector are passed on the stack (dispatcher/handlers
cleanup will be addressed in a separate CL).

These two stub ports have to be combined in one CL because:
1) without changing the StoreTransitionDescriptor TF was not able to compile them
on ia32/x87 (because of lack of registers),
2) it was not possible to change the descriptor first because Crankshaft was not able
to deal with the stack allocated parameters in case of a stub failure.

TBR=jkummerow@chromium.org
BUG=v8:5269

Review-Url: https://codereview.chromium.org/2313093002
Cr-Commit-Position: refs/heads/master@{#39476}

BUG=

Review-Url: https://codereview.chromium.org/2333243004
Cr-Commit-Position: refs/heads/master@{#39398}

To make better inlining decisions, it's good to have call counts for poly/mega-morphic cases. This CL makes it work for calls, and another will follow to better unify the code between constructor calls and normal calls (and thence, to record megamorphic call counts there as well).

BUG=

Review-Url: https://codereview.chromium.org/2325083003
Cr-Commit-Position: refs/heads/master@{#39377}

Migrate the platform ToName stub to TurboFan.

BUG=v8:5049

Review-Url: https://codereview.chromium.org/2302923002
Cr-Commit-Position: refs/heads/master@{#39315}

Adds support to collect allocation site feedback for Array function calls
to the call bytecode handler.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2307903002
Cr-Commit-Position: refs/heads/master@{#39283}

This way we avoid the cyclic dependency between objects.h and heap.h and still
have one definition. Add a static assert that this size is indeed smaller than
the payload of a page.

Follow ups can finally remove the dependency on spaces.h for all heap.h users.

R=ulan@chromium.org,bmeurer@chromium.org,vogelheim@chromium.og

Review-Url: https://codereview.chromium.org/2311203002
Cr-Commit-Position: refs/heads/master@{#39206}

Collect type feedback in the bytecode handler for 'new' bytecode. The
earlier cl (https://codereview.chromium.org/2153433002/) was reverted
because that implementation did not collect allocation site feedback.
This regressed delta blue by an order of magnitude. This implementation
includes collection of allocation site feedback.

Reland of https://codereview.chromium.org/2190293003/ with a bug fix.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2225923003
Cr-Commit-Position: refs/heads/master@{#39120}

BUG=
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2286613002
Cr-Commit-Position: refs/heads/master@{#39054}

Drive-by fix: the order of parameters in the BinaryOpWithFeedback TurboFan code stubs now reflects the convention of having the context at the end.

BUG=v8:5273

Review-Url: https://codereview.chromium.org/2263253002
Cr-Commit-Position: refs/heads/master@{#38832}

Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

Fixing it:
- Don't include stuff in headers unless necessary.
- Include the stuff you need, not some other stuff that happens to include the
stuff you need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2258603003
Cr-Commit-Position: refs/heads/master@{#38770}

BUG=

Review-Url: https://codereview.chromium.org/2250913002
Cr-Commit-Position: refs/heads/master@{#38693}

The hand-written KeyedLoadIC_Megamorphic stub didn't care about JSArray
lengths, which made it lenient towards said lengths being wrong, but it
will soon fix that bug and thereby become more strict.

LiveEdit: factory->NewJSArray(capacity) doesn't set a length, so set it
manually.
RegExp: to avoid having to take care of array length updating in the
RegExpExecStub, just use a JSObject instead.

Review-Url: https://codereview.chromium.org/2244673002
Cr-Commit-Position: refs/heads/master@{#38624}

Revert of [Interpreter] Collect type feedback for 'new' in the bytecode handler (patchset #6 id:100001 of https://codereview.chromium.org/2190293003/ )

Reason for revert:
[Sheriff] Fails on nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/8403

Original issue's description:
> [Interpreter] Collect type feedback for 'new' in the bytecode handler
>
> Collect type feedback in the bytecode handler for 'new' bytecode. The
> earlier cl (https://codereview.chromium.org/2153433002/) was reverted
> because that implementation did not collect allocation site feedback.
> This regressed delta blue by an order of magnitude. This implementation
> includes collection of allocation site feedback.
>
> BUG=v8:4280, v8:4780
> LOG=N
>
> Committed: https://crrev.com/9d5e6129c4c7f9cbfe81a5fad2a470f219fe137c
> Cr-Commit-Position: refs/heads/master@{#38364}

TBR=bmeurer@chromium.org,rmcilroy@chromium.org,balazs.kilvady@imgtec.com,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4780

Review-Url: https://codereview.chromium.org/2212343002
Cr-Commit-Position: refs/heads/master@{#38368}

Collect type feedback in the bytecode handler for 'new' bytecode. The
earlier cl (https://codereview.chromium.org/2153433002/) was reverted
because that implementation did not collect allocation site feedback.
This regressed delta blue by an order of magnitude. This implementation
includes collection of allocation site feedback.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2190293003
Cr-Commit-Position: refs/heads/master@{#38364}

A corresponding flag was added as well to help us find out what breaks when we
do not clear pending exceptions on each JS entry.

BUG=5259

Review-Url: https://codereview.chromium.org/2208663002
Cr-Commit-Position: refs/heads/master@{#38292}

Replace hydrogen stub for typeof with TurboFan stub.

BUG=chromium:608675

Review-Url: https://codereview.chromium.org/2195863002
Cr-Commit-Position: refs/heads/master@{#38227}

This will enable the interpreter to add a bytecode and use the stub.

BUG=v8:4280
LOG=n

Review-Url: https://codereview.chromium.org/2177273002
Cr-Commit-Position: refs/heads/master@{#38219}

In the process also inline the stub into the appropriate interpreter bytecode
handler and make sure that the context register is preserved in hand-written
assembly code that calls the stub and expects the context register to be
preserved.

BUG=608675

Review-Url: https://codereview.chromium.org/2188993003
Cr-Commit-Position: refs/heads/master@{#38132}

This feature has not been used in the past few years and most likely does not
even work anymore.

R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2186533002
Cr-Commit-Position: refs/heads/master@{#38046}

Original message:

Calling Runtime::kAbort through a builtin instead of the c-entry stub
will allow to generate the call in a background thread, because a
builtin provides its own handle, whereas a code stub does not.

@v8-mips-ports: Could you take a special look at the padding that is
done in MacroAssembler::Abort()?

Reason for revert:
The reason for reverting is: Blocks roll:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/1622

The problem was that on arm64 the builtin for Abort() contained a call to
Abort(). The problem is fixed by using a NoUseRealAbortsScope in the
code generation of Abort().

R=titzer@chromium.org, rmcilroy@chromium.org, rodolph.perfetta@arm.com

Review-Url: https://codereview.chromium.org/2163263002
Cr-Commit-Position: refs/heads/master@{#37929}

This CL fixes weird performance implications when changing layout of Code::flags field:
it happened that the unused ICStateField with MONOMORPHIC value in the handlers' flags
was accidentally offsetting the underflow bug in stub cache probing code on arm, arm64,
mips and mips64.

Stub cache tests now work even when snapshot is enabled.

Drive-by-change: Fixed counters manipulation on arm64 and mips64.

BUG=chromium:618701

Review-Url: https://codereview.chromium.org/2161153002
Cr-Commit-Position: refs/heads/master@{#37910}

This avoids implementation-defined signed overflow in the simulator's
AddWithCarry implementation. The implementation of AddWithCarry now uses
unsigned arithmetic exclusively.

Testing coverage is also significantly improved.

BUG=

Review-Url: https://codereview.chromium.org/2157283003
Cr-Commit-Position: refs/heads/master@{#37895}

Revert of [builtins] Introduce a builtin for Abort(). (patchset #5 id:80001 of https://codereview.chromium.org/2156923002/ )

Reason for revert:
Blocks roll: https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/1622

Original issue's description:
> [builtins] Introduce a builtin for Abort().
>
> Calling Runtime::kAbort through a builtin instead of the c-entry stub
> will allow to generate the call in a background thread, because a
> builtin provides its own handle, whereas a code stub does not.
>
> @v8-mips-ports: Could you take a special look at the padding that is
> done in MacroAssembler::Abort()?
>
> R=bmeurer@chromium.org, titzer@chromium.org, mstarzinger@chromium.org, v8-mips-ports@googlegroups.com, v8-arm-ports@googlegroups.com
>
> Committed: https://crrev.com/9be015a254cfff871c56cd129523a729637e9158
> Cr-Commit-Position: refs/heads/master@{#37854}

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,titzer@chromium.org,v8-arm-ports@googlegroups.com,v8-mips-ports@googlegroups.com,akos.palfi@imgtec.com,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2163603003
Cr-Commit-Position: refs/heads/master@{#37883}

Calling Runtime::kAbort through a builtin instead of the c-entry stub
will allow to generate the call in a background thread, because a
builtin provides its own handle, whereas a code stub does not.

@v8-mips-ports: Could you take a special look at the padding that is
done in MacroAssembler::Abort()?

R=bmeurer@chromium.org, titzer@chromium.org, mstarzinger@chromium.org, v8-mips-ports@googlegroups.com, v8-arm-ports@googlegroups.com

Review-Url: https://codereview.chromium.org/2156923002
Cr-Commit-Position: refs/heads/master@{#37854}

So far TurboFan wasn't adding the deoptimization reasons for eager/soft
deoptimization exits that can be used by either the DevTools profiler or
the --trace-deopt flag. This adds basic support for deopt reasons on
Deoptimize, DeoptimizeIf and DeoptimizeUnless nodes and threads through
the reasons to the code generation.

Also moves the DeoptReason to it's own file (to resolve include cycles)
and drops unused reasons.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2161543002
Cr-Commit-Position: refs/heads/master@{#37823}

All stores require a Slot parameter so VectorStoreICTrampolineDescriptor is a new StoreDescriptor.

VectorStoreICDescriptor renamed to StoreWithVectorDescriptor.

Review-Url: https://codereview.chromium.org/2147043002
Cr-Commit-Position: refs/heads/master@{#37779}

Original commit message:

  Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
  to a EhFrameWriter and will attach unwinding information to the code
  object when passed one.

Reason for reverting:

  The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc
  causes a compiler error on V8 Win64 - clang buildbot.

  Removing that bit.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37754}

VectorStoreICStub -> StoreICStub
VectorStoreICTrampolineStub -> StoreICTrampolineStub
VectorKeyedStoreICStub -> KeyedStoreICStub
VectorKeyedStoreICTrampolineStub -> KeyedStoreICTrampolineStub

Review-Url: https://codereview.chromium.org/2147013002
Cr-Commit-Position: refs/heads/master@{#37752}

R=bmeurer@chromium.org
BUG=v8:5197

Review-Url: https://codereview.chromium.org/2145023002
Cr-Commit-Position: refs/heads/master@{#37740}

Revert of Reland Implement .eh_frame writer and disassembler. (patchset #74 id:2070001 of https://codereview.chromium.org/2023503002/ )

Reason for revert:
Blocks roll https://codereview.chromium.org/2148743003/

See https://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_rel_ng/builds/244252/steps/compile%20%28with%20patch%29/logs/stdio for error message

Original issue's description:
> Reland Implement .eh_frame writer and disassembler.
>
> Original commit message:
>
>   Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
>   to a EhFrameWriter and will attach unwinding information to the code
>   object when passed one.
>
> Reason for reverting:
>
>   The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc
>   causes a compiler error on V8 Win64 - clang buildbot.
>
>   Removing that bit.
>
> BUG=v8:4899
> LOG=N
>
> Committed: https://crrev.com/b413f0ebe1a5dde016bfb94bb80bf872ebc24372
> Cr-Commit-Position: refs/heads/master@{#37707}

TBR=rmcilroy@chromium.org,jarin@chromium.org,ssanfilippo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4899

Review-Url: https://codereview.chromium.org/2147883003
Cr-Commit-Position: refs/heads/master@{#37717}

After this CL we can avoid using Code::flags in hash computations for megamorphic
stub caches and therefore the unused ICState field can be finally removed from flags.

BUG=chromium:618701

Review-Url: https://codereview.chromium.org/2123983004
Cr-Commit-Position: refs/heads/master@{#37708}

Original commit message:

  Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
  to a EhFrameWriter and will attach unwinding information to the code
  object when passed one.

Reason for reverting:

  The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc
  causes a compiler error on V8 Win64 - clang buildbot.

  Removing that bit.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37707}

Collect type feedback in the call bytecode handler. The current
implementation only collects feedback for JS function objects. The other
objects and Array functions do not collect any feedback. They will be
marked Megamorphic.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2122183002
Cr-Commit-Position: refs/heads/master@{#37700}