Improve instruction selector for mask and shift operations by using cheaper
instructions where possible, in preference to UBFX.

Reverted because it was suspected of causing a couple of flaky tests to fail,
but investigation suggests this is unlikely.

Original review: https://codereview.chromium.org/1677023002

BUG=

Review URL: https://codereview.chromium.org/1684073006

Cr-Commit-Position: refs/heads/master@{#33988}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1694183002

Cr-Commit-Position: refs/heads/master@{#33987}

Turn the fast case of ArgumentsAccessStub into a new stub
FastNewSloppyArgumentsStub, which is similar to the existing
FastNewStrictArgumentsStub, although not polished yet, and the slow
case always went to the runtime anyway, so we can just directly emit
a runtime call there.

R=mstarzinger@chromium.org

Committed: https://crrev.com/55b0b4f6d572531eec00ab6ebd8f6feb7c584e04
Cr-Commit-Position: refs/heads/master@{#33973}

Review URL: https://codereview.chromium.org/1695633003

Cr-Commit-Position: refs/heads/master@{#33986}

Fixed frame size is larger when embedded constant pools are enabled.

R=oth@chromium.org, rmcilroy@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1692973002

Cr-Commit-Position: refs/heads/master@{#33985}

  port 5de27c34(r33865)

  original commit message:
  Calls use registers for target, new_target and argument count.
  We don't always respect argument count. It didn't bite us in the past
  because the code paths where we clobbered it never used it, though
  in future it could be an issue.

BUG=

Review URL: https://codereview.chromium.org/1698823002

Cr-Commit-Position: refs/heads/master@{#33984}

R=jkummerow@chromium.org
BUG=v8:4757
LOG=N

Review URL: https://codereview.chromium.org/1700693002

Cr-Commit-Position: refs/heads/master@{#33983}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1694643004

Cr-Commit-Position: refs/heads/master@{#33982}

This CL improves running our internal benchmarks locally by adding the
--pretty option to tools/run_perf.py. With the flag enabled we print
the run-time of each benchmark directly and avoid the json output at
the end.

NOTRY=true

Review URL: https://codereview.chromium.org/1681283004

Cr-Commit-Position: refs/heads/master@{#33981}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1695083002

Cr-Commit-Position: refs/heads/master@{#33980}

R=ahaas@chromium.org,aseemgarg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1699793002

Cr-Commit-Position: refs/heads/master@{#33979}

Add a section identifier for declaring a start function as an index into
the function table. (This could also be done as a decl flag on the
function, but don't feel strongly here, since we probably want to redo
this when adding an import/export section.)

The start function must accept no parameters. Its return value is
currently ignored.

R=binji@chromium.org,bradnelson@chromium.org
BUG=chromium:575167
LOG=Y

Review URL: https://codereview.chromium.org/1692173002

Cr-Commit-Position: refs/heads/master@{#33978}

Adds support for ES6 super keyword and performing loads, stores, and
calls to super class members.

Implements SetHomeObject and enables ThisFunctionVariable.

BUG=v8:4280,v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1689573004

Cr-Commit-Position: refs/heads/master@{#33977}

Revert of [runtime] Turn ArgumentAccessStub into FastNewSloppyArgumentsStub. (patchset #2 id:20001 of https://codereview.chromium.org/1695633003/ )

Reason for revert:
[Sheriff] Breaks ASAN with mipsel compile:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20ASAN%20mipsel%20-%20debug%20builder/builds/4558/

Original issue's description:
> [runtime] Turn ArgumentAccessStub into FastNewSloppyArgumentsStub.
>
> Turn the fast case of ArgumentsAccessStub into a new stub
> FastNewSloppyArgumentsStub, which is similar to the existing
> FastNewStrictArgumentsStub, although not polished yet, and the slow
> case always went to the runtime anyway, so we can just directly emit
> a runtime call there.
>
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/55b0b4f6d572531eec00ab6ebd8f6feb7c584e04
> Cr-Commit-Position: refs/heads/master@{#33973}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1701653002

Cr-Commit-Position: refs/heads/master@{#33976}

This is mostly preparation for allowing the function closure to be materialized.

As a drive-by fix, I have added ignition source position support to the frame inspector (this fixed some ignition test failures).

Review URL: https://codereview.chromium.org/1698743002

Cr-Commit-Position: refs/heads/master@{#33975}

Initially we were unable to address certain stack slots in the callee
part of the frame, including the function marker, therefore we had to
hack a reload of the function register into the OSR prologue. Now that
we are able to address all stack slots, we no longer need this hack.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1666073002

Cr-Commit-Position: refs/heads/master@{#33974}

Turn the fast case of ArgumentsAccessStub into a new stub
FastNewSloppyArgumentsStub, which is similar to the existing
FastNewStrictArgumentsStub, although not polished yet, and the slow
case always went to the runtime anyway, so we can just directly emit
a runtime call there.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1695633003

Cr-Commit-Position: refs/heads/master@{#33973}

This adds initial support for inline allocation of object and array
literals to the JSCreateLowering pass. It's basically identical to
what Crankshaft does.

This also unstages the TurboFan escape analysis, as the lowering seems
to trigger a bunch of bugs in it; those bugs will be fixed separately,
and we will re-enable escape analysis afterwards.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1698783002

Cr-Commit-Position: refs/heads/master@{#33972}

  port 3ef573e9(r33809)

  original commit message:
  Replace the somewhat awkward RestParamAccessStub, which would always
  call into the runtime anyway with a proper FastNewRestParameterStub,
  which is basically based on the code that was already there for strict
  arguments object materialization. But for rest parameters we could
  optimize even further (leading to 8-10x improvements for functions with
  rest parameters), by fixing the internal formal parameter count:

  Every SharedFunctionInfo has a formal_parameter_count field, which
  specifies the number of formal parameters, and is used to decide whether
  we need to create an arguments adaptor frame when calling a function
  (i.e. if there's a mismatch between the actual and expected parameters).
  Previously the formal_parameter_count included the rest parameter, which
  was sort of unfortunate, as that meant that calling a function with only
  the non-rest parameters still required an arguments adaptor (plus some
  other oddities). Now with this CL we fix, so that we do no longer
  include the rest parameter in that count. Thereby checking for rest
  parameters is very efficient, as we only need to check whether there is
  an arguments adaptor frame, and if not create an empty array, otherwise
  check whether the arguments adaptor frame has more parameters than
  specified by the formal_parameter_count.

  The FastNewRestParameterStub is written in a way that it can be directly
  used by Ignition as well, and with some tweaks to the TurboFan backends
  and the CodeStubAssembler, we should be able to rewrite it as
  TurboFanCodeStub in the near future.

  Drive-by-fix: Refactor and unify the CreateArgumentsType which was
  different in TurboFan and Ignition; now we have a single enum class
  which is used in both TurboFan and Ignition.

BUG=

Review URL: https://codereview.chromium.org/1696063002

Cr-Commit-Position: refs/heads/master@{#33971}

  port cfbd2561(r33857)

  original commit message:
  Preparing the young generation for (real) non-contiguous backing memory, this
  change removes object masks that are used to compute containment in semi and new
  space. The masks are replaced by lookups for object tags and page headers, where
  possible.

  Details:
  - Use the fast checks (page header lookups) for containment in regular code.
  - Use the slow version that masks out the page start adress and iterates all
    pages of a space for debugging/verification.
  - The slow version works for off-heap/unmapped memory.
  - Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

BUG=

Review URL: https://codereview.chromium.org/1698803002

Cr-Commit-Position: refs/heads/master@{#33970}

  port 2166bd8c (r33797)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1697953002

Cr-Commit-Position: refs/heads/master@{#33969}

Rolling v8/build/gyp to 2f9ffdc96135eaa102ee90584e7c6e5e5c45915c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1701613002

Cr-Commit-Position: refs/heads/master@{#33968}

  port 187b3f28 (r33796)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1700583002

Cr-Commit-Position: refs/heads/master@{#33967}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1691373002

Cr-Commit-Position: refs/heads/master@{#33966}

When we specialize to the native context, we can replace loads of the
NATIVE_CONTEXT_INDEX in any known context with the appropriate native
context for that context. This allows us to constant-fold and further
optimize things like %reflect_construct, which are inserted by the
parser.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1697513003

Cr-Commit-Position: refs/heads/master@{#33965}

Older versions of Emscripten appear to emit Asm.js containing:
HEAP8[x] with x in int
As opposed to the spec legal construct:
HEAP8[x>>0] with x in int

As older programs and even benchmarks such as Embenchen
include these constructs, support them for compatibility.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator,mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1692713006

Cr-Commit-Position: refs/heads/master@{#33964}

Port 09d84535

Original commit message:
    The FastNewStrictArgumentsStub is very similar to the recently added
    FastNewRestParameterStub, it's actually almost a copy of it, except that
    it doesn't have the fast case we have for the empty rest parameter. This
    patch improves strict arguments in TurboFan and fullcodegen by up to 10x
    compared to the previous version.

    Also introduce proper JSSloppyArgumentsObject and JSStrictArgumentsObject
    for the in-object properties instead of having them as constants in the
    Heap class.

    Drive-by-fix: Use this stub and the FastNewRestParameterStub in the
    interpreter to avoid the runtime call overhead for strict arguments
    and rest parameter creation.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1696743002

Cr-Commit-Position: refs/heads/master@{#33963}

Port a2935d63

Original commmit message:
    Saves and restores the dispatch pointer during calls to enable the debugger to
    switch the dispatch table used by a function during it's execution.

    Also moves the accumulator and context nodes to be Variables so that they will
    be properly merged across branches.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1688373002

Cr-Commit-Position: refs/heads/master@{#33962}

This is hopefully the last in a series of cleanup patches around
destructuring assignment. It simplifies the ParseAssignmentExpression
API, making the callers call CheckDestructuringElement() where appropriate.
CheckDestructuringElement has been further simplified to only emit the
errors that the parser depends on it emitting.

I've also beefed up the test coverage in test-parsing.cc to
handling all the destructuring flags being on, which caught an oddity
in how we disallow initializers in spreads in patterns (we need to treat
RewritableAssignmentExpressions as Assignments for the purpose of
error checking).

Finally, I added a few helper methods to ParserBase to handle a few
classes of expressions (assignments and literals-as-patterns).

Review URL: https://codereview.chromium.org/1696603002

Cr-Commit-Position: refs/heads/master@{#33961}

This behavior was changed in https://codereview.chromium.org/1402913002.
It's pretty usefull to have ability to disable debugger statement for our users.

BUG=chromium:583515
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1690173002

Cr-Commit-Position: refs/heads/master@{#33960}

This change expands allocation sampling to include old, map, code, and large object spaces. This involved refactoring much of the observation logic out of NewSpace into Space and overriding as needed in sub-classes.

Additionally, the sampling heap profiler now maintains a pair of heap observers. One observer is used for observing new space and resetting the inline allocation limit to be periodically notified of allocations. The other observes allocation across the other spaces where there is no additional work required to observe allocations.

Tests have been updated to ensure that allocations are observed correctly for Paged and LargeObject spaces.

R=ofrobots@google.com, hpayer@chromium.org, ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1625753002

Cr-Commit-Position: refs/heads/master@{#33959}

R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1690343002

Cr-Commit-Position: refs/heads/master@{#33958}

R=mtrofin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1690863006

Cr-Commit-Position: refs/heads/master@{#33957}

Since wasm has no direct notion of foreign globals,
pass the ffi object on to the AsmWasmBuilder
so that foreign globals can be extracted at module
instantiation time.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1677373002

Cr-Commit-Position: refs/heads/master@{#33956}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1698473003

Cr-Commit-Position: refs/heads/master@{#33955}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1692223002

Cr-Commit-Position: refs/heads/master@{#33954}

Recent flake happened bacause all the samples landed into native code.
The patch makes sure we collect enough JS samples.

BUG=v8:4751
LOG=N

Review URL: https://codereview.chromium.org/1695663002

Cr-Commit-Position: refs/heads/master@{#33953}

Adds JumpIfNotHoleConstant and JumpIfNotHoleConstantWide bytecodes
and removes JumpIfHole bytecode.

In situations with large numbers of constants, the generator would
fail because an 8-bit constant could not be reserved for
JumpIfHole/JumpIfNotHole and so a 16-bit constant would be reserved.
Then when patching the bytecode the patcher would discover there was
no wide constant variant of the emitted jump.

BUG=v8:4280,v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1697473002

Cr-Commit-Position: refs/heads/master@{#33952}

Port e519e6fa

Original commit message:
    1) Update profiling counters in Full codegen.
    2) Call Runtime::kTraceTailCall when tracing is on

    test/mjsunit/es6/tail-call-simple.js is disabled for now, because Turbofan does not fully support TCO yet.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1690953003

Cr-Commit-Position: refs/heads/master@{#33951}

Authorize people with try-job access to do dry runs.
Change to faster blink trybot in 20% experiment.

NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1692943002

Cr-Commit-Position: refs/heads/master@{#33950}

This avoids having to read the context and call through from the inlined
path in the JSReceiver case.

BUG=

Review URL: https://codereview.chromium.org/1698463002

Cr-Commit-Position: refs/heads/master@{#33949}