Port c1e7c8d9

Original commit message:
    This ensures that the ArgumentsAdaptorTrampoline does not clobber the
    new.target value, but rather passes it through to the callee unaltered.
    Note that callees do not yet use the new.target value so far.

    This is a preparatory CL to allows us passing new.target in a register
    instead of via a side-channel through the construct stub frame.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1467923004

Cr-Commit-Position: refs/heads/master@{#32184}

Port c6d310da

Original commit message:
    * Adds a PrepareForTailCall instruction that bumps the stack in the case that
      the number of parameters passed to the callee causes the stack to exceed the
      calleer's frame size.
    * Uses the gap resolver to move the saved caller return address and frame
      pointer to the approprate location in the tail-called frame.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1460183003

Cr-Commit-Position: refs/heads/master@{#32183}

Port 2fc2cb99

Original commit message:
    The old code was not ready for properly initialize objects with non
    standard headers and non zero in-object properties number.

    MacroAssembler::Allocate() implementations now return both start and
    end addresses of the new object (done by parameter renaming).

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1472473003

Cr-Commit-Position: refs/heads/master@{#32182}

Port f6e689ce

Original commit message:
    The TruncateFloat64ToUint64 operator converts a float64 to an uint64 using
    round-to-zero rounding mode (truncate). If the input value is outside uint64
    range, then the result depends on the architecture.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1460093002

Cr-Commit-Position: refs/heads/master@{#32181}

Port ceade6cf

Original commit message:
    This adds a new %NewArray runtime entry, which constructs a new JSArray
    and does the subclassing correctly (to the same degree that %NewObject
    does currently), and also deals properly with the AllocationSite
    feedback mechanism. This runtime entry will be used by TurboFan and is
    also used as a fallback in the subclassing case in the stub currently.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:3101, v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1466943002

Cr-Commit-Position: refs/heads/master@{#32180}

The LoadElimination in TurboFan can look into the atomic regions and
elimination subsequent loads based on stores/allocations in that atomic
regions.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1472703005

Cr-Commit-Position: refs/heads/master@{#32179}

BUG=2487
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1466323002

Cr-Commit-Position: refs/heads/master@{#32178}

Add an eager deoptimization location for JSCallConstruct and adapt the
JSCallReducer to consume target feedback for construction sites (only
applies to explicit new F(...args) not the super constructor calls).
Also recognize the new Array(...args) constructs with only target
feedback.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1467173002

Cr-Commit-Position: refs/heads/master@{#32177}

BUG=2487
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1468943002

Cr-Commit-Position: refs/heads/master@{#32176}

Review URL: https://codereview.chromium.org/1467193002

Cr-Commit-Position: refs/heads/master@{#32175}

Review URL: https://codereview.chromium.org/1471723002

Cr-Commit-Position: refs/heads/master@{#32174}

Revert of [heap] Preserve optimized code maps accross GCs. (patchset #1 id:1 of https://codereview.chromium.org/1430293002/ )

Reason for revert:
Janks finalization of full GC.

Original issue's description:
> [heap] Preserve optimized code maps accross GCs.
>
> This disables the eager flushing of optimized code maps during full GCs
> and instead treats entries in those tables weakly by default. Note that
> for now entries are removed when one of its components dies.
>
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/7a1377aab2ba4e2c9a7d422b51f645cbbaec10c7
> Cr-Commit-Position: refs/heads/master@{#32045}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1467213002

Cr-Commit-Position: refs/heads/master@{#32173}

There's no point in collecting feedback for super constructor calls,
because in all (interesting) cases we can gather (better) feedback from
other sources (i.e. via inlining or via using a LOAD_IC to get to the
[[Prototype]] of the target).  So CallConstructStub is now only used
for new Foo(...args) sites where we want to collect feedback in the
baseline compiler.  The optimizing compilers, Reflect.construct and
super constructor calls use the Construct builtin directly, which allows
us to remove some weird code from the CallConstructStub (and opens the
possibility for more code sharing with the CallICStub, maybe even going
for a ConstructICStub).

Also remove the 100% redundant HCallNew instruction, which is just a
wrapper for the Construct builtin anyway (indirectly via the
CallConstructStub).

Drive-by-fix: Drop unused has_function_cache bit on Code objects.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4413, v8:4430
LOG=n

Review URL: https://codereview.chromium.org/1469793002

Cr-Commit-Position: refs/heads/master@{#32172}

This ensures that the ArgumentsAdaptorTrampoline does not clobber the
new.target value, but rather passes it through to the callee unaltered.
Note that callees do not yet use the new.target value so far.

This is a preparatory CL to allows us passing new.target in a register
instead of via a side-channel through the construct stub frame.

R=mvstanton@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1458103003

Cr-Commit-Position: refs/heads/master@{#32171}

This simplifies the layout of dependent code array and optimizes it for sparse dependency groups.

BUG=chromium:554488
LOG=NO

Review URL: https://codereview.chromium.org/1435313002

Cr-Commit-Position: refs/heads/master@{#32170}

BUG=chromium:559141
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1466233002

Cr-Commit-Position: refs/heads/master@{#32169}

The feature sometimes prevents subsequent swarming bots to
delete the work directory on windows.

The data file is not kept on swarming bots anyways, therefore
this switches off the feature completely.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1468933002

Cr-Commit-Position: refs/heads/master@{#32168}

  port d80fd48e (r32163)

  original commit message:
  The CallICStub has call-site specific knowledge about the receiver,
  which we did not utilize; plus the CallICStub does in some case know
  whether it is about to [[Call]] a function or potentially some other
  callable. In the common case we actually know that the target is a
  function and so we can use the CallFunction builtin directly instead
  of redispatching in the Call builtin.

BUG=

Review URL: https://codereview.chromium.org/1467123002

Cr-Commit-Position: refs/heads/master@{#32167}

  port 4e004564 (r31625)

  original commit message:
  X87: Fix the sqrt precision issue.

    In order to resolve the sqrt precision issue described in https://codereview.chromium.org/1425763002/.
    we change the implementation of CreateSqrtFunction() implementation of X87 so that the optimize compiler
    and full-compiler implementation are unified.

BUG=

Review URL: https://codereview.chromium.org/1470793004

Cr-Commit-Position: refs/heads/master@{#32166}

BUG=2487
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1467973002

Cr-Commit-Position: refs/heads/master@{#32165}

BUG=2487
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1457223005

Cr-Commit-Position: refs/heads/master@{#32164}

The CallICStub has call-site specific knowledge about the receiver,
which we did not utilize; plus the CallICStub does in some case know
whether it is about to [[Call]] a function or potentially some other
callable. In the common case we actually know that the target is a
function and so we can use the CallFunction builtin directly instead
of redispatching in the Call builtin.

BUG=chromium:555127, v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1470803002

Cr-Commit-Position: refs/heads/master@{#32163}

  port c6d310da (r32151)

  original commit message:
  * Adds a PrepareForTailCall instruction that bumps the stack in the case that
    the number of parameters passed to the callee causes the stack to exceed the
    calleer's frame size.
  * Uses the gap resolver to move the saved caller return address and frame
    pointer to the approprate location in the tail-called frame.

BUG=

Review URL: https://codereview.chromium.org/1472703002

Cr-Commit-Position: refs/heads/master@{#32162}

  port 2fc2cb99 (r32144)

  original commit message:
  The old code was not ready for properly initialize objects with non standard headers and non zero in-object properties number.

  MacroAssembler::Allocate() implementations now return both start and end addresses of the new object (done by parameter renaming).

BUG=

Review URL: https://codereview.chromium.org/1467923002

Cr-Commit-Position: refs/heads/master@{#32161}

  port ceade6cf (r32131)

  original commit message:
  This adds a new %NewArray runtime entry, which constructs a new JSArray
  and does the subclassing correctly (to the same degree that %NewObject
  does currently), and also deals properly with the AllocationSite
  feedback mechanism. This runtime entry will be used by TurboFan and is
  also used as a fallback in the subclassing case in the stub currently.

BUG=

Review URL: https://codereview.chromium.org/1462283003

Cr-Commit-Position: refs/heads/master@{#32160}

Review URL: https://codereview.chromium.org/1471533002

Cr-Commit-Position: refs/heads/master@{#32159}

Rolling v8/tools/clang to f1ac92b46273db6ba0286cc1fe214d1aaa788f6d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1466073003

Cr-Commit-Position: refs/heads/master@{#32158}

Rolling v8/tools/clang to c37aa129283791664a03189e495e5ff2a4077288

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1464063002

Cr-Commit-Position: refs/heads/master@{#32157}

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1448183002

Cr-Commit-Position: refs/heads/master@{#32156}

This lets us pass one test262 test (and seems to match what other
implementations do to handle this case).

R=littledan@chromium.org
BUG=v8:4362
LOG=n

Review URL: https://codereview.chromium.org/1454543003

Cr-Commit-Position: refs/heads/master@{#32155}

Remove unused descriptor slack from strict functions to avoid breaking initial map descriptor sharing invariant.

BUG=chromium:555542
LOG=N

Review URL: https://codereview.chromium.org/1457223004

Cr-Commit-Position: refs/heads/master@{#32154}

We should not be counting the bump pointer allocations done during scavenge as
the objects are copied. The inline allocation observers were getting unnecessary
notifications.

R=hpayer@chromium.org, ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1465633002

Cr-Commit-Position: refs/heads/master@{#32153}

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1461133003

Cr-Commit-Position: refs/heads/master@{#32152}

* Adds a PrepareForTailCall instruction that bumps the stack in the case that
  the number of parameters passed to the callee causes the stack to exceed the
  calleer's frame size.
* Uses the gap resolver to move the saved caller return address and frame
  pointer to the approprate location in the tail-called frame.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1455833004

Cr-Commit-Position: refs/heads/master@{#32151}

This will allow callers (e.g. the infra recipe) to check
which steps have been executed and monitor success/failure.

BUG=chromium:559141
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1463143004

Cr-Commit-Position: refs/heads/master@{#32150}

TEST=unittests/InstructionSelectorTest.Word32XorMinusOneWithWord32Or,
     Word64XorMinusOneWithWord64Or
BUG=

Review URL: https://codereview.chromium.org/1459723002

Cr-Commit-Position: refs/heads/master@{#32149}

Original issue's description:
> Prepare to enable in-object properties in subclasses on a case by case basis.
>
> Minor cleanup in VisitorId selection.
>
> Committed: https://crrev.com/7c449a62edfc03aed84d94da323dcfe2b51a3600
> Cr-Commit-Position: refs/heads/master@{#32030}

This is a mostly clean reland.

Review URL: https://codereview.chromium.org/1459133002

Cr-Commit-Position: refs/heads/master@{#32148}

Port f6e689ce

BUG=

Review URL: https://codereview.chromium.org/1463193002

Cr-Commit-Position: refs/heads/master@{#32147}

BUG=4134
R=epertoso@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1458003006

Cr-Commit-Position: refs/heads/master@{#32146}

Introduce a JSCreateArray operator that represents the Array
constructor, and lower call and construct calls to the Array
constructor to JSCreateArray. Currently we don't yet replace
that with an inline allocation, but always use the specialized
stubs for the Array constructor.

This saves a lot of unnecessary deopts and elements transitions
because now we can actually consume the allocation site feedback
for the transitions.

R=mstarzinger@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1466643002

Cr-Commit-Position: refs/heads/master@{#32145}