Port 961a45da

BUG=

Review-Url: https://codereview.chromium.org/2505923002
Cr-Commit-Position: refs/heads/master@{#41284}

This code is no longer used in full-codegen or ast-graph-builder since all
functions which have class literals go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2534463002
Cr-Commit-Position: refs/heads/master@{#41282}

This removes support for try-catch as well as try-finally constructs
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=jarin@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2521233002
Cr-Commit-Position: refs/heads/master@{#41279}

This code is no longer used by full-codegen since all functions which use with statments,
call eval or have lookup variable access now go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2514393002
Cr-Commit-Position: refs/heads/master@{#41276}

This has two parts:
- in redundancy elimination, if we see addition with left hand side that
  was bounds-checked, we reconnect the lhs to the bounds check if it has better
  type.
- in representation inference, eliminate overflow checks if the input types
  guarantee no overflow.

Review-Url: https://codereview.chromium.org/2527083002
Cr-Commit-Position: refs/heads/master@{#41260}

The deprecated pipeline is used for asm.js only, where we forcibly
disable inlining anyways (for performance reasons), so inlining via
the AstGraphBuilder is essentially dead code by now, thus there's no
point in trying to keep that around in the code base.

Also nuke the test-run-inlining.cc file, which would require some heavy
surgery (for probably little benefit), and move the useful tests for
mjsunit tests instead.

BUG=v8:2206,v8:5657
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527053002
Cr-Commit-Position: refs/heads/master@{#41245}

Recognize Date.now() calls in the Typer and assign the proper integer
type to them.

See Node issue https://github.com/nodejs/node/issues/9729 for more
information.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2528853003
Cr-Commit-Position: refs/heads/master@{#41242}

Also lower JSToBoolean(x) where x is either some detectable receiver or
null, or any kind of receiver, null or undefined. Also fix a couple of
minor issues with the JSToBoolean lowering and tests.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2530773002
Cr-Commit-Position: refs/heads/master@{#41241}

Recognize a couple of builtins on the RegExp.prototype in the Typer and
assign useful types to them, so we can optimize various checks on their
results.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2531463002
Cr-Commit-Position: refs/heads/master@{#41240}

This fixes a bug where the re-creation of phi nodes leads to divergence. The fix makes sure that once a node created a phi node, it sticks to it and does not forget about it, even if the inputs suddenly agree again. The bug appeared on the trybots in https://codereview.chromium.org/2512733003/.

Also I added a line to mark effect phi nodes on the queue. This is unrelated, but seems to be an obvious ommission.

R=bmeurer@chromium.org
BUG=v8:5633

Review-Url: https://codereview.chromium.org/2522253002
Cr-Commit-Position: refs/heads/master@{#41239}

Since we are specializing on the native context, we don't have to load
the vector from the closure. For one thing, this reduces the machinery for
nodes that use a vector in their generic incarnation.

BUG=
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2529463002
Cr-Commit-Position: refs/heads/master@{#41221}

This fixes the message reported via the {TypeError} thrown when trying
to call a non-constructable function as a constructor. Also adds some
more related message tests for similar exceptions.

R=bmeurer@chromium.org
TEST=message/call-non-constructable
BUG=chromium:661579

Review-Url: https://codereview.chromium.org/2523803003
Cr-Commit-Position: refs/heads/master@{#41220}

The AstGraphBuilder pipeline is only used for asm.js now, so the whole
type feedback mechanism is essentially dead code currently, thus we
better nuke it.

BUG=v8:5267,v8:5657

Review-Url: https://codereview.chromium.org/2523953002
Cr-Commit-Position: refs/heads/master@{#41201}

Now that we have a JumpLoop bytecode, we can heavily simplify the
branch/loop analysis by assuming that only JumpLoop bytecodes are
backwards edges, and performing the loop analysis as a single
(backwards) pass.

This allows us to get rid of the branch analysis entirely, and builds a
framework to do liveness analysis in the same pass.

Review-Url: https://codereview.chromium.org/2519983002
Cr-Commit-Position: refs/heads/master@{#41194}

Previous fuzzer fix broke the case when the pending assessment came from the same
block. In that case, the assessments table does not have an entry yet for the block,
because we register only when we're done processing a block.

BUG=667745

Review-Url: https://codereview.chromium.org/2519973004
Cr-Commit-Position: refs/heads/master@{#41193}

Wrapper creation for import functions with i64 return values on 32-bit
platforms crashed because the number of return values of the wrapper
did not match the number of input nodes of the return node.

The issue is fixed by not creating special wrappers for 32-bit platforms
in the first place. This is valid because wrappers with i64 return
values are never actually executed.

R=titzer@chromium.org
BUG=v8:5661

Review-Url: https://codereview.chromium.org/2517173003
Cr-Commit-Position: refs/heads/master@{#41190}

BUG=chromium:664117

Review-Url: https://codereview.chromium.org/2522883002
Cr-Commit-Position: refs/heads/master@{#41173}

When disassembling functions for the inspector, we used an internal
text representation before. This CL implements the official text
format like it is understood by the spec interpreter.

Example output:
func $main (param i32) (result i32)
block i32
  get_local 0
  i32.const 2
  i32.lt_u
  if
    i32.const -2
    return
  end
  get_local 0
  call_indirect 0
end

R=rossberg@chromium.org, titzer@chromium.org
BUG=chromium:659715

Review-Url: https://codereview.chromium.org/2520943002
Cr-Commit-Position: refs/heads/master@{#41172}

BUG=chromium:667689
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2518313002
Cr-Commit-Position: refs/heads/master@{#41169}

The new SourcePosition class allows for precise tracking of source positions including the stack of inlinings. This CL makes the cpu profiler use this new information. Before, the cpu profiler used the deoptimization data to reconstruct the inlining stack. However, optimizing compilers (especially Turbofan) can hoist out checks such that the inlining stack of the deopt reason and the inlining stack of the position the deoptimizer jumps to can be different (the old cpu profiler tests and the ones introduced in this cl produce such situations for turbofan). In this case, relying on the deoptimization info produces paradoxical results, where the reported position is before the function responsible is called. Even worse, https://codereview.chromium.org/2451853002/ combines the precise position with the wrong inlining stack from the deopt info, leading to completely wrong results.

Other changes in this CL:
- DeoptInlinedFrame is no longer needed, because we can compute the correct inlining stack up front.
- I changed the cpu profiler tests back to test situations where deopt checks are hoisted out in Turbofan and made them robust enough to handle the differences between Crankshaft and Turbofan.
- I reversed the order of SourcePosition::InliningStack to make it match the cpu profiler convention.
- I removed CodeDeoptEvent::position, as it is no longer used.

R=alph@chromium.org

BUG=v8:5432

Review-Url: https://codereview.chromium.org/2503393002
Cr-Commit-Position: refs/heads/master@{#41168}

TurboFan can indeed comsume NumberOrOddball feedback for abstract
relational comparisons, so we should just provide it from Ignition.

Drive-by-fix: Add a DCHECK to protect against abstract/strict equality
number comparison accidentially utilizing Oddball feedback.

BUG=v8:5267,v8:5400
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2518283002
Cr-Commit-Position: refs/heads/master@{#41166}

Make use of the previously introduced String feedback for compare
operations in TurboFan.

R=jarin@chromium.org
BUG=v8:5267,v8:5400

Review-Url: https://codereview.chromium.org/2523463002
Cr-Commit-Position: refs/heads/master@{#41163}

 - Simd Scalar lowering should be conditionally disabled if the architecture has a native SIMD implementation.
 - Enable scalar lowering tests on all architectures instead of only x64.

R=bbudge@chromium.org, aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2514663002
Cr-Commit-Position: refs/heads/master@{#41160}

The verifier needs to use the block and assessments in that block corresponding to
a predecessor of a "pending" assessment. Not doing that causes incorrect
assessments when 2 locations are swapped.

BUG=665402

Review-Url: https://codereview.chromium.org/2515803002
Cr-Commit-Position: refs/heads/master@{#41159}

BUG=v8:5296

Review-Url: https://codereview.chromium.org/2320753002
Cr-Commit-Position: refs/heads/master@{#41151}

Add/Shl to Lsa optimization doesn't yield any performance increase in case
one of the operand is immediate, because Lsa cannot use the immediate so
we use an extra instruction to load the immediate to register. On MIPSR2 and
less this optimization leads to performance degradation, since Lsa is not
supported on these architectures and it is emulated using Add/Shl which
do support immediate as operand for Add.

BUG=

Review-Url: https://codereview.chromium.org/2509203003
Cr-Commit-Position: refs/heads/master@{#41143}

Revert of [turbofan] Introduce LoadFunctionPrototype simplified operator. (patchset #1 id:1 of https://codereview.chromium.org/2517913002/ )

Reason for revert:
Blocks roll https://codereview.chromium.org/2517963002/

Original issue's description:
> [turbofan] Introduce LoadFunctionPrototype simplified operator.
>
> Add a LoadFunctionPrototype simplified operator, similar to what
> Crankshaft has, that loads the prototype property of a constructor
> function.
>
> R=jarin@chromium.org
> BUG=v8:5267
>
> Committed: https://crrev.com/1737b2c74b50168e96ef1263def0eb43505fa80c
> Cr-Commit-Position: refs/heads/master@{#41127}

TBR=jarin@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2514363002
Cr-Commit-Position: refs/heads/master@{#41141}

This renames the {operand_stack} field to {register_file}, to refelct
how said field is used on all {JSGeneratorObject} instances by now. This
is a pure refactoring CL, not changes in semantics.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2520913002
Cr-Commit-Position: refs/heads/master@{#41140}

This removes the deprecated generator support for resumable functions
from {FullCodeGenerator}. The existing {AstNumbering} heuristic already
triggers Ignition for most resumable functions, with this change we make
said heuristic a hard choice and remove the deprecated code. This also
has the advantage that any suspended {JSGeneratorObject} instance on the
heap is guaranteed to have code based on a bytecode array.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2504223002
Cr-Commit-Position: refs/heads/master@{#41135}

Add a LoadFunctionPrototype simplified operator, similar to what
Crankshaft has, that loads the prototype property of a constructor
function.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2517913002
Cr-Commit-Position: refs/heads/master@{#41127}

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2518513002
Cr-Commit-Position: refs/heads/master@{#41119}

BUG=666622, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2515683002
Cr-Commit-Position: refs/heads/master@{#41118}

A simple Print API for debugging assessments in the regalloc
verifier.

BUG=

Review-Url: https://codereview.chromium.org/2512943003
Cr-Commit-Position: refs/heads/master@{#41117}

This is a next step towards removing names table from type feedback metadata.

BUG=chromium:576312, v8:5561

Review-Url: https://codereview.chromium.org/2507143003
Cr-Commit-Position: refs/heads/master@{#41106}

Add bytecode for defining data properties, which initially just calls the runtime function.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2510743002
Cr-Commit-Position: refs/heads/master@{#41101}

This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}

With this change, WebAssembly.Memory objects have backing stores allocated as an
8GB region where everything beyond the size of the Wasm heap is inaccessible.

GrowMemory is now implemented by changing the protection on the guard regions to
make the new portions of the heap accessible.

Guard pages are not enabled by default, but this change adds a flag and a test
variant to make sure we get test coverage on them.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2396433008
Cr-Commit-Position: refs/heads/master@{#41089}

Adds --wasm-no-bounds-checks and --wasm-no-stack-checks which
help in diagnosing potential sources of slowdown in WASM code.

R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2511113002
Cr-Commit-Position: refs/heads/master@{#41083}

Collect string feedback for compare operations. Without this,
functions which have a lot of string compare operations end up with
a high generic type percentage, and don't get optimized until very
late.

Currently TurboFan doesn't use this String feedback for compare
operations, but this could be done in future work if it is useful.

BUG=chromium:660947

Review-Url: https://codereview.chromium.org/2506013005
Cr-Commit-Position: refs/heads/master@{#41078}

The control edges in a TurboFan graph can form a cycle. To break this cycle in the int64-lowering we add special handling for loop nodes. Similar handling already exists for phi nodes and effectphi nodes, which breaks cycles formed by value edges and effect edges, respectively.

Review-Url: https://codereview.chromium.org/2511503002
Cr-Commit-Position: refs/heads/master@{#41071}