This introduces a dedicated getter to extract call descriptors from
operators of call nodes (i.e. call and tail-call) to ensure that all
accesses are const-correct. An implicit cast of constness is undefined
behavior and hard to spot without sanitization.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1894983002

Cr-Commit-Position: refs/heads/master@{#35570}

This fixes undefined behavior introduced by extracting the const call
descriptor of a call node as non-const. Such an implicit cast between
constness is not safe and should be avoided.

R=ahaas@chromium.org
TEST=unittests/Int64LoweringTest.CallI64Parameter
BUG=v8:4924
LOG=n

Review URL: https://codereview.chromium.org/1900563002

Cr-Commit-Position: refs/heads/master@{#35569}

Adds code to call FunctionEntryHook on entry to the InterpreterEntryTrampoline.
This should give SyzyProf enough information to build non-discontinous profile
graphs, however since interpreter functions aren't uniquely identified they will
all get lumped into one bucket. This should be good enough for SyzyProf's current
use-case.

BUG=v8:4763
LOG=N

Review URL: https://codereview.chromium.org/1884133002

Cr-Commit-Position: refs/heads/master@{#35568}

This disables parsing when we optimize directly from bytecode using
TurboFan, because TurboFan is capable of building graphs out of the
bytecode directly.

R=bmeurer@chromium.org
BUG=v8:4280
LOG=n

Review URL: https://codereview.chromium.org/1891663004

Cr-Commit-Position: refs/heads/master@{#35567}

Reland of Immediately cache compiled scripts. (patchset #1 id:1 of https://codereview.chromium.org/1882833006/ )

Reason for revert:
Fixed webkit_unit_tests

Original issue's description:
> Revert of Immediately cache compiled scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1890083002/ )
>
> Reason for revert:
> [Sheriff] Breaks:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/8769
>
> Auto-bisect points to this CL.
>
> Original issue's description:
> > Immediately cache compiled scripts.
> >
> > Usually, script compilation is expensive enough to warrant the extra
> > overhead of caching scripts immediatly.
> >
> > BUG=chromium:588900
> > R=yangguo@chromium.org
> > LOG=n
> >
> > Committed: https://crrev.com/3533c084d470912384988768c4b3b109304da357
> > Cr-Commit-Position: refs/heads/master@{#35527}
>
> TBR=yangguo@chromium.org,jochen@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:588900
>
> Committed: https://crrev.com/f8a5a4da70d0a8e6dbb1b5c633c2b6b47fe5c3f6
> Cr-Commit-Position: refs/heads/master@{#35536}

TBR=yangguo@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:588900
LOG=n

Review URL: https://codereview.chromium.org/1901573002

Cr-Commit-Position: refs/heads/master@{#35566}

This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in.

This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes.

Review URL: https://codereview.chromium.org/1849603002

Cr-Commit-Position: refs/heads/master@{#35565}

Even if there's already one in memory

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1900483002

Cr-Commit-Position: refs/heads/master@{#35564}

BUG=

Committed: https://crrev.com/4c2b04542f263b2679194f9fb75672ebbe72b924
Cr-Commit-Position: refs/heads/master@{#35330}

Committed: https://crrev.com/7fdfdc12d4e4291348112ace4278a827f57f2eb9
Cr-Commit-Position: refs/heads/master@{#35494}

Review URL: https://codereview.chromium.org/1838283003

Cr-Commit-Position: refs/heads/master@{#35563}

Add support to optimize certain comparisons of typeof with known
strings to utilize the existing ObjectIs<Type> predicates. Also
add a new ObjectIsCallable, which is used to optimize the common
typeof x === "function" pattern.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1898653003

Cr-Commit-Position: refs/heads/master@{#35562}

  port 0c05e02f (r35480)

  original commit message:
  Modifies Ignition to store code entry addresses in the dispatch table
  rather than code objects. This allows the interpreter to avoid
  calculating the code entry address from the code object on every
  dispatch and provides a ~5-7% performance improvement on Octane with
  Ignition.

  This change adds ArchOpcode::kArchTailCallAddress to TurboFan to enable
  tail call dispatch using these code addresses. It also adds a Dispatch
  linkage creator (distinct from the stub linkage type used previously) to
  allow targetting a code address target (which will diverge further from
  the stub linkage type when we remove the context machine register in
  Ignition).

BUG=

Review URL: https://codereview.chromium.org/1893243002

Cr-Commit-Position: refs/heads/master@{#35561}

  port 5e9ddf6c (r35453)

  original commit message:
  Reland of (https://codereview.chromium.org/1617503003)

  * New atomic code stubs for x64, ia32, arm, arm64
  * Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
    to macro-assembler-ia32 (API based on x64 macro assembler)
  * Remove runtime implementation of Atomics.load, the code stub should always be
    called instead
  * Add new test to mjsunit atomics test; check that Smi values of different
    sizes are supported when possible, else fall back to HeapNumbers

  These changes were needed to add another codestub:
  * Bump kStubMajorKeyBits from 7 to 8
  * Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12

BUG=

Review URL: https://codereview.chromium.org/1894923002

Cr-Commit-Position: refs/heads/master@{#35560}

Revert "[wasm] Quickfix for register allocation problem on ia32."

This reverts commit 2ca31b63.

BUG=

Review URL: https://codereview.chromium.org/1824303002

Cr-Commit-Position: refs/heads/master@{#35559}

  port c2de9611(r35440)

  original commit message:
  Visit the Optimized Code Map on first call rather than closure creation.

  This is useful for escape analysis, and helps upcoming changes to
  type feedback gathering.

BUG=

Review URL: https://codereview.chromium.org/1893213002

Cr-Commit-Position: refs/heads/master@{#35558}

optimizer was merging phi lowering moves into the node defining the
phi. Addressing such cases proved to be too difficult in the existing
validator.

The new validator addresses this, by making no assumptions on phi
lowering details.

This unblocks 1824303002.

BUG=

Review URL: https://codereview.chromium.org/1855023002

Cr-Commit-Position: refs/heads/master@{#35557}

  port 52148c41 (r35407)

  original commit message:
  Add relocatable pointers for wasm memory references that need to be updated when wasm GrowMemory is used. Code generator changes to accept relocatable constants as immediates.

BUG=

Review URL: https://codereview.chromium.org/1895673002

Cr-Commit-Position: refs/heads/master@{#35556}

  port 2e329666(r35370)

  original commit message:
  ... instead of doing stack magic.  This is a cleanup in preparation for the new generators implementation.

BUG=

Review URL: https://codereview.chromium.org/1893943002

Cr-Commit-Position: refs/heads/master@{#35555}

  port ce1fe78d (r35331)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1893173002

Cr-Commit-Position: refs/heads/master@{#35554}

WASM codes always have a StackFrame::Type marker.

BUG=

Review URL: https://codereview.chromium.org/1879543002

Cr-Commit-Position: refs/heads/master@{#35553}

These operators are really pure on the JavaScript level, and were only
part of the effect chain to make sure we don't accidentially schedule
them right after raw allocations, which is no longer an issue since we
now have the concept of atomic regions.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1893543004

Cr-Commit-Position: refs/heads/master@{#35552}

Revert of [turbofan] Improve lowering of ObjectIs<Type> somewhat. (patchset #1 id:1 of https://codereview.chromium.org/1872143002/ )

Reason for revert:
Looking at types in ChangeLowering is generally unsafe.

Original issue's description:
> [turbofan] Improve lowering of ObjectIs<Type> somewhat.
>
> If we already know that the input to one of the ObjectIs<Type> nodes is
> TaggedPointer, we don't need to perform the Smi check at runtime.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/4fc4978cee0bb7ad2ae8681a67b7032eba6a7d11
> Cr-Commit-Position: refs/heads/master@{#35368}

TBR=jarin@chromium.org,bmeurer@google.com
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1893123002

Cr-Commit-Position: refs/heads/master@{#35551}

R=jarin@chromium.org

Committed: https://crrev.com/20eff45de11609934be339dffe46276ff0a4bc22
Cr-Commit-Position: refs/heads/master@{#35509}

Review URL: https://codereview.chromium.org/1887343002

Cr-Commit-Position: refs/heads/master@{#35550}

Revert of [turbofan] Remove the leftover LoadBuffer hacks. (patchset #1 id:1 of https://codereview.chromium.org/1887343002/ )

Reason for revert:
Using types in ChangeLowering is generally unsafe.

Original issue's description:
> [turbofan] Remove the leftover LoadBuffer hacks.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/20eff45de11609934be339dffe46276ff0a4bc22
> Cr-Commit-Position: refs/heads/master@{#35509}

TBR=jarin@chromium.org,mstarzinger@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1893893002

Cr-Commit-Position: refs/heads/master@{#35549}

Revert of [Atomics] Remove Atomics code stubs; use TF ops (patchset #6 id:100001 of https://codereview.chromium.org/1891033002/ )

Reason for revert:
[Sheriff] Breaks
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20ASAN%20mipsel%20-%20debug%20builder/builds/6121

Original issue's description:
> [Atomics] Remove Atomics code stubs; use TF ops
>
> This is a much cleaner solution, which won't require nearly as much
> architecture-specific code. Thanks bmeurer@!
>
> BUG=v8:4614
> LOG=y
> R=bmeurer@chromium.org,jarin@chromium.org
>
> Committed: https://crrev.com/6ff5881b1def45b35384572f61327e42563a89c3
> Cr-Commit-Position: refs/heads/master@{#35547}

TBR=bmeurer@chromium.org,jarin@chromium.org,rodolph.perfetta@gmail.com,binji@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review URL: https://codereview.chromium.org/1895643002

Cr-Commit-Position: refs/heads/master@{#35548}

This is a much cleaner solution, which won't require nearly as much
architecture-specific code. Thanks bmeurer@!

BUG=v8:4614
LOG=y
R=bmeurer@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1891033002

Cr-Commit-Position: refs/heads/master@{#35547}

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1893713002

Cr-Commit-Position: refs/heads/master@{#35546}

Revert of Get rid of UnsafeCurrent in Sampler (patchset #12 id:220001 of https://codereview.chromium.org/1858143003/ )

Reason for revert:
[Sheriff] Breaks tsan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/8999

Original issue's description:
> Get rid of UnsafeCurrent in Sampler
>
> Currently we are using UnsafeCurrent in async signal handler to acquire the
> isolate of VM thread, but we want to get rid of that since it prevents V8 from
> being thread agnostic.
>
> This patch replaces UnsafeCurrent with a static map, where we store a map of
> samplers for threads, and makes it accessible by signal handler.
>
> BUG=v8:4889
> LOG=n
>
> Committed: https://crrev.com/62fb4775fea0d56d8a175baf1d902213f6752168
> Cr-Commit-Position: refs/heads/master@{#35541}

TBR=jochen@chromium.org,alph@chromium.org,fmeawad@chromium.org,yangguo@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4889

Review URL: https://codereview.chromium.org/1897673002

Cr-Commit-Position: refs/heads/master@{#35545}

Revert of Migrate FastCloneShallowObjectStub to TurboFan (patchset #9 id:180001 of https://codereview.chromium.org/1838283003/ )

Reason for revert:
The boilerplate is copied based on the boilerplate + memento size, which reads off the end of the boilerplate.

Original issue's description:
> Migrate FastCloneShallowObjectStub to TurboFan
>
> BUG=
>
> Committed: https://crrev.com/4c2b04542f263b2679194f9fb75672ebbe72b924
> Cr-Commit-Position: refs/heads/master@{#35330}
>
> Committed: https://crrev.com/7fdfdc12d4e4291348112ace4278a827f57f2eb9
> Cr-Commit-Position: refs/heads/master@{#35494}

TBR=bmeurer@chromium.org,jkummerow@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1888043006

Cr-Commit-Position: refs/heads/master@{#35544}

BUG=602659
LOG=N

Review URL: https://codereview.chromium.org/1891203002

Cr-Commit-Position: refs/heads/master@{#35543}

This patch correctly re-scopes inner scopes that can appear in do
expressions used as initializers to arrow parameters.

R=rossberg@chromium.org
BUG=v8:4904
LOG=N

Review URL: https://codereview.chromium.org/1887743002

Cr-Commit-Position: refs/heads/master@{#35542}

Currently we are using UnsafeCurrent in async signal handler to acquire the
isolate of VM thread, but we want to get rid of that since it prevents V8 from
being thread agnostic.

This patch replaces UnsafeCurrent with a static map, where we store a map of
samplers for threads, and makes it accessible by signal handler.

BUG=v8:4889
LOG=n

Review URL: https://codereview.chromium.org/1858143003

Cr-Commit-Position: refs/heads/master@{#35541}

BUG=

Review URL: https://codereview.chromium.org/1887343004

Cr-Commit-Position: refs/heads/master@{#35540}

Runtime_OptimizeFunctionOnNextCall and Runtime_DeoptimizeFunction asserts that
the argument is a JSFunction object.These are used by fuzzers to get coverage
of optimizations in compiler. Having an assert causes a fuzzer test to fail
when OptimizeFunctionOnNextCall is called on objects that are not functions.
We can instead, silently return on such calls.

BUG=chromium:601391
LOG=N

Review URL: https://codereview.chromium.org/1883603002

Cr-Commit-Position: refs/heads/master@{#35539}

BUG=v8:4909
R=hpayer@chromium.org,ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1890123002

Cr-Commit-Position: refs/heads/master@{#35538}

Port 5e9ddf6c

Original commit message:
    * New atomic code stubs for x64, ia32, arm, arm64
    * Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
      to macro-assembler-ia32 (API based on x64 macro assembler)
    * Remove runtime implementation of Atomics.load, the code stub should always be
      called instead
    * Add new test to mjsunit atomics test; check that Smi values of different
      sizes are supported when possible, else fall back to HeapNumbers

    These changes were needed to add another codestub:
    * Bump kStubMajorKeyBits from 7 to 8
    * Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12

R=binji@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=v8:4614
LOG=N

Review URL: https://codereview.chromium.org/1882733008

Cr-Commit-Position: refs/heads/master@{#35537}

Revert of Immediately cache compiled scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1890083002/ )

Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/8769

Auto-bisect points to this CL.

Original issue's description:
> Immediately cache compiled scripts.
>
> Usually, script compilation is expensive enough to warrant the extra
> overhead of caching scripts immediatly.
>
> BUG=chromium:588900
> R=yangguo@chromium.org
> LOG=n
>
> Committed: https://crrev.com/3533c084d470912384988768c4b3b109304da357
> Cr-Commit-Position: refs/heads/master@{#35527}

TBR=yangguo@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:588900

Review URL: https://codereview.chromium.org/1882833006

Cr-Commit-Position: refs/heads/master@{#35536}

Unports parts of https://codereview.chromium.org/1828543003
as per suggestion in
https://codereview.chromium.org/1886293002/

Ports https://codereview.chromium.org/1532723003

Also restores -fmsc-version=1800 to support win-clang with
MSVS 2013.

BUG=chromium:603011
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1895453002

Cr-Commit-Position: refs/heads/master@{#35535}

Port 9336f4cc

Original commit message:
    This is useful for escape analysis, and helps upcoming changes to
    type feedback gathering.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1887003004

Cr-Commit-Position: refs/heads/master@{#35534}

Port 0c05e02f

Original commit message:
    Modifies Ignition to store code entry addresses in the dispatch table
    rather than code objects. This allows the interpreter to avoid
    calculating the code entry address from the code object on every
    dispatch and provides a ~5-7% performance improvement on Octane with
    Ignition.

    This change adds ArchOpcode::kArchTailCallAddress to TurboFan to enable
    tail call dispatch using these code addresses. It also adds a Dispatch
    linkage creator (distinct from the stub linkage type used previously) to
    allow targetting a code address target (which will diverge further from
    the stub linkage type when we remove the context machine register in
    Ignition).

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1887263003

Cr-Commit-Position: refs/heads/master@{#35533}

This hoists all bailouts out of OptimizedCompileJob::CreateGraph into
the compiler pipeline. The reason is that this moves them to a point
where we can still influence the decision which compiler to pick and
hence gives us more freedom with modeling various pipelines.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1883313003

Cr-Commit-Position: refs/heads/master@{#35532}

BUG=

Review URL: https://codereview.chromium.org/1887343003

Cr-Commit-Position: refs/heads/master@{#35531}