TEST=
BUG=

Review URL: https://codereview.chromium.org/1031113002

Cr-Commit-Position: refs/heads/master@{#27441}

This switches full-codegen to no longer push and pop StackHandler
markers onto the operand stack, but relies on a range-based handler
table instead. We only use StackHandlers in JSEntryStubs to mark the
transition from C to JS code.

Note that this makes deoptimization and OSR from within any try-block
work out of the box, makes the non-exception paths faster and should
overall be neutral on the memory footprint (pros).

On the other hand it makes the exception paths slower and actually
throwing and exception more expensive (cons).

R=yangguo@chromium.org
TEST=cctest/test-run-jsexceptions/DeoptTry

Review URL: https://codereview.chromium.org/1010883002

Cr-Commit-Position: refs/heads/master@{#27440}

BUG=chromium:434952
LOG=n

Review URL: https://codereview.chromium.org/1035613003

Cr-Commit-Position: refs/heads/master@{#27439}

R=verwaest@chromium.org
BUG=chromium:470113
LOG=N

Review URL: https://codereview.chromium.org/1034523002

Cr-Commit-Position: refs/heads/master@{#27438}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1029583009

Cr-Commit-Position: refs/heads/master@{#27437}

TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1036843002

Cr-Commit-Position: refs/heads/master@{#27436}

Tests for non-clearing of weak cells in LoadICs weren't running when
vector ICs are enabled.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032843002

Cr-Commit-Position: refs/heads/master@{#27435}

This commit has changed the enum names:

33994b4a

`FIELD` is now called `DATA`.

BUG=
R=danno

Review URL: https://codereview.chromium.org/1033733003

Cr-Commit-Position: refs/heads/master@{#27434}

> There are two reasons that could cause invalid slots appearance in SlotsBuffer:
> 1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
> 2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).

> This CL also adds useful machinery that helps triggering incremental write barriers.

> BUG=chromium:454297
> LOG=Y

NOTRY=true

Review URL: https://codereview.chromium.org/1032833002

Cr-Commit-Position: refs/heads/master@{#27433}

Revert of [turbofan] Enable --turbo-osr. (patchset #1 id:1 of https://codereview.chromium.org/1035643002/)

Reason for revert:
Crash in pdfjs benchmark.

Original issue's description:
> [turbofan] Enable --turbo-osr.
>
> R=yangguo@chromium.org
> BUG=
>
> Committed: https://crrev.com/50305aac39f90b6455305313db56ff3365ec96f5
> Cr-Commit-Position: refs/heads/master@{#27431}

TBR=titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1005163003

Cr-Commit-Position: refs/heads/master@{#27432}

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1035643002

Cr-Commit-Position: refs/heads/master@{#27431}

Port 6689cc27

Original commit message:
Handlers should be in charge of this work. The change uncovered a bug in
vector-ics related to keyed loads into strings. It's important for
StringCharCodeAtGenerator, a helper used in full code and in
LoadIndexedStringStub (a handler) to protect the vector and slot registers
when it makes a runtime call to convert a HeapNumber to a Smi.

It's still possible for the handler to MISS after this call, perhaps due
to out of bounds access. In that case, the vector and slot registers need
to be delivered safely to the MISS handler.

R=mbrandy@us.ibm.com, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1029413002

Cr-Commit-Position: refs/heads/master@{#27430}

port 3aa206b8 (r27329)

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1022523005

Cr-Commit-Position: refs/heads/master@{#27429}

Port 56d2ee03

Original commit message:

R=mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1036453002

Cr-Commit-Position: refs/heads/master@{#27428}

Revert of Track how many pages trigger fallback strategies in GC (patchset #2 id:20001 of https://codereview.chromium.org/1029323003/)

Reason for revert:
This seems to cause lots of crashes in layout tests debug:
../../third_party/WebKit/Source/bindings/core/v8/V8PerIsolateData.cpp(67) : void blink::useCounterCallback(v8::Isolate *, v8::Isolate::UseCounte

http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2332

Original issue's description:
> Track how many pages trigger fallback strategies in GC
>
> R=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/bb880058f6499510cff12d98dc7d524d35d769cb
> Cr-Commit-Position: refs/heads/master@{#27421}

TBR=hpayer@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1000523003

Cr-Commit-Position: refs/heads/master@{#27427}

Revert of Filter invalid slots out from the SlotsBuffer after marking. (patchset #6 id:220001 of https://codereview.chromium.org/1010363005/)

Reason for revert:
Need to revert in order to revert https://codereview.chromium.org/1029323003/

Original issue's description:
> Filter invalid slots out from the SlotsBuffer after marking.
>
> There are two reasons that could cause invalid slots appearance in SlotsBuffer:
> 1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
> 2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
>
> This CL also adds useful machinery that helps triggering incremental write barriers.
>
> BUG=chromium:454297
> LOG=Y
>
> Committed: https://crrev.com/5c47c1c0d3e4a488f190c16a64ee02f5a14e6561
> Cr-Commit-Position: refs/heads/master@{#27423}

TBR=hpayer@chromium.org,erik.corry@gmail.com,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:454297

Review URL: https://codereview.chromium.org/1033453005

Cr-Commit-Position: refs/heads/master@{#27426}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1018513003

Cr-Commit-Position: refs/heads/master@{#27425}

The root cause for the bug is that the positions assigned to desugared
code was inconsistent with the source ranges of block scopes.
Since the fact that the position is assigned causes the debugger to
break at the parser-generated statement, the fix is to remove positions
from those nodes that we do not want to break on.

The CL also teaches Hydrogen to tolerate these cases.

R=adamk@chromium.org,rossberg@chromium.org
BUG=chromium:468661
LOG=Y

Review URL: https://codereview.chromium.org/1032653002

Cr-Commit-Position: refs/heads/master@{#27424}

There are two reasons that could cause invalid slots appearance in SlotsBuffer:
1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).

This CL also adds useful machinery that helps triggering incremental write barriers.

BUG=chromium:454297
LOG=Y

Review URL: https://codereview.chromium.org/1010363005

Cr-Commit-Position: refs/heads/master@{#27423}

Gather references to unbound variables where the reference (VariableProxy) is
inside strong mode. Check them against the global object when a script is bound
to a context (during compilation).

This CL only checks unbound variables which are not inside lazy functions - TBD
how do we solve that; alternatives: add developer mode which disables laziness /
do the check whenever lazy functions are really compiled.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1005063002

Cr-Commit-Position: refs/heads/master@{#27422}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1029323003

Cr-Commit-Position: refs/heads/master@{#27421}

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1034513002

Cr-Commit-Position: refs/heads/master@{#27420}

BUG=chromium:450004
R=yangguo@chromium.org, kozyatinskiy@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1030673002

Cr-Commit-Position: refs/heads/master@{#27419}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1014093008

Cr-Commit-Position: refs/heads/master@{#27418}

Some code in type-info.cc could allow a cross context map to be visible to
crankshaft. Tighten up this code to be certain that only a JSFunction, an
AllocationSite or a Symbol can be returned.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1026343004

Cr-Commit-Position: refs/heads/master@{#27417}

R=machenbach@chromium.org
BUG=408675
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1025553007

Cr-Commit-Position: refs/heads/master@{#27416}

These are needed (among other things) for a TurboFan-generated
StringAddStub. Furthermore, they can be used to nuke the overly
complex %_IsInstanceType intrisic, it's completely expressible in
JavaScript now, but that will be done in a separate CL.

Alpha-sorted things a bit on the way to ease navigation.

Review URL: https://codereview.chromium.org/1010973010

Cr-Commit-Position: refs/heads/master@{#27415}

Also introduce --trace-fragmentation-verbose, and fix --always-compact.

R=ulan@chromium.org
BUG=v8:3976
LOG=y

Review URL: https://codereview.chromium.org/1024823002

Cr-Commit-Position: refs/heads/master@{#27414}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1029843002

Cr-Commit-Position: refs/heads/master@{#27413}

This fixes flaky GC stress failure:

> Fatal error in ../src/heap/mark-compact.cc, line 2127
> Check failed: retained_maps->Get(i)->IsWeakCell().

BUG=
TEST=test-heap/RegressArrayListGC

Review URL: https://codereview.chromium.org/1026113004

Cr-Commit-Position: refs/heads/master@{#27412}

This removes the CompilationInfoWithZone class from the header file
because it is more than a pure convenience class and shouldn't be used
outside of the compiler at all.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1000353004

Cr-Commit-Position: refs/heads/master@{#27411}

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1029383002

Cr-Commit-Position: refs/heads/master@{#27410}

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1031803004

Cr-Commit-Position: refs/heads/master@{#27409}

BUG=

Review URL: https://codereview.chromium.org/1034473002

Cr-Commit-Position: refs/heads/master@{#27408}

additionally, add a drive by fix to WeakCallbackInfo

R=jochen@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1026283004

Cr-Commit-Position: refs/heads/master@{#27407}

The test demonstrates a bad interaction between arguments object
materialization, escape analysis and exception handling.

We can return a wrong arguments object if we materialize arguments
object (using f.arguments) and then throw around f's frame so that f
does not clean up the materialized frame information (see the
MaterializedObjectStore in deoptimizer.h/.cc). If we enter another
function that has the same frame pointer and request an arguments object
of (or lazily deoptimize) that function, we can get the materialized
object of the original function.

We should clean up the materialized object store when we unwind the
stack.

BUG=v8:3985
LOG=n

Review URL: https://codereview.chromium.org/1032623003

Cr-Commit-Position: refs/heads/master@{#27406}

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1036433002

Cr-Commit-Position: refs/heads/master@{#27405}

Remove Variable::IsValidReference(), and the Variable::is_valid_ref_
member: This was "false" only for "this", and for internal variables.
For the first, VariableProxy::is_this() can be used for the check
instead; and for internal variables, it is guaranteed they they will
not be written to (because the V8 code does not do it, and they are
not accessible from JavaScript).

The "bool is_this" parameter of VariableProxy() constructor is
changed to use Variable::Kind. This will allow to later on adding
a parameter to create unresolved variables of any kind, which in
turn will be used to make references to "this" initially unresolved,
and use the existing variable resolution mechanics for "this".

BUG=v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1024703004

Cr-Commit-Position: refs/heads/master@{#27404}

it is the last patch of https://codereview.chromium.org/1012633002

All that we need here is to push the collected info to the profiler
and convert it into actionable information about deopt.

On the Next: get the info accessible by embedder.

BUG=chromium:452067
LOG=n
TEST=DeoptAtFirstLevelInlinedSource, DeoptAtSecondLevelInlinedSource, DeoptUntrackedFunction

Review URL: https://codereview.chromium.org/1013143003

Cr-Commit-Position: refs/heads/master@{#27403}

BUG=v8:3980
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1027183002

Cr-Commit-Position: refs/heads/master@{#27402}