Port 9846f386

Original commit message:
    The literal index is being pushed onto the stack while evaluating
    the non-constant subexpressions, but never used in fullcodegen (and
    hence not used in the optimizing compilers).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1468273005

Cr-Commit-Position: refs/heads/master@{#32229}

R=epertoso@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1470173003

Cr-Commit-Position: refs/heads/master@{#32228}

Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
`value`. Generally, `value` may have a range bigger than the one that
could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
instead, and only if the `value` fits into Float64 without precision
loss.

Add missing mjsunit test for 52bit multiplication/division optimization
that has landed in refs/heads/master@{#31899}.

BUG=
R=titzer@google.com

Review URL: https://codereview.chromium.org/1433353006

Cr-Commit-Position: refs/heads/master@{#32227}

Revert of Move --harmony-destructuring-bind to shipping (patchset #5 id:80001 of https://codereview.chromium.org/1451843002/ )

Reason for revert:
Fails on V8 Fuzzer: https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/6028

Original issue's description:
> Move --harmony-destructuring-bind to shipping
>
> Also fix CheckConflictingVarDeclarations() to properly handle
> legacy const bindings. Without that change enabling the flag
> causes code like:
>
>   function f() { const x; var x; }
>
> to throw an early error, rather than wait to throw the error
> until f is invoked.
>
> BUG=v8:811
> LOG=y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/515093630a4a925a66d550561e38293d49633f10
> Cr-Commit-Position: refs/heads/master@{#32222}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1470333002

Cr-Commit-Position: refs/heads/master@{#32226}

Revert of [Interpreter] Add CreateClosure to BytecodeGraphBuilder. (patchset #8 id:140001 of https://codereview.chromium.org/1458603012/ )

Reason for revert:
Build break.

Original issue's description:
> [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
>
> Adds code and tests to support CreateClosure bytecode when building
> graphs.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/4cceb11b0929abcbc82bf0854554a9b66003335d
> Cr-Commit-Position: refs/heads/master@{#32224}

TBR=bmeurer@chromium.org,mythria@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1471913004

Cr-Commit-Position: refs/heads/master@{#32225}

Adds code and tests to support CreateClosure bytecode when building
graphs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1458603012

Cr-Commit-Position: refs/heads/master@{#32224}

BUG=

Review URL: https://codereview.chromium.org/1467473002

Cr-Commit-Position: refs/heads/master@{#32223}

Also fix CheckConflictingVarDeclarations() to properly handle
legacy const bindings. Without that change enabling the flag
causes code like:

  function f() { const x; var x; }

to throw an early error, rather than wait to throw the error
until f is invoked.

BUG=v8:811
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1451843002

Cr-Commit-Position: refs/heads/master@{#32222}

sufficient physical registers for all the virtual registers.

This should come in handy for frame elision. There, I noticed that even
for very small functions (==very few virtual registers), because we spill
the context/function marker ranges, we lose the frame elision
opportunity.

There is a subsequent change needed to fully help frame elision -
decoupling spilling of context & function marker from prologue.

BUG=

Review URL: https://codereview.chromium.org/1469743002

Cr-Commit-Position: refs/heads/master@{#32221}

Change the runtime entries and their associated code stubs for object
and array literal creation to take the closure instead of the raw
literals pointer. This is way easier to deal with (and cleaner) in
TurboFan.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1469833005

Cr-Commit-Position: refs/heads/master@{#32220}

Reshuffle registers in JSConstructStub to avoid trashing costructor and new.target on fast path (so we don't need to push/pop them).

This CL also fixed register usages in MacroAssembler::Allocate() broken by 2fc2cb99 (r32144).

BUG=chromium:560239
LOG=Y

Review URL: https://codereview.chromium.org/1468073004

Cr-Commit-Position: refs/heads/master@{#32219}

Optimize ClearNonLiveReferences: collect dependent code only from maps that are embedded in optimize code.

BUG=chromium:554488
LOG=NO

Review URL: https://codereview.chromium.org/1471703002

Cr-Commit-Position: refs/heads/master@{#32218}

We still share the code globally, but if we wanted, it would be easy to
make it per isolate now

BUG=v8:2487
R=yangguo@chromium.org,jkummerow@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1468313004

Cr-Commit-Position: refs/heads/master@{#32217}

Having access to the unfinished schedule inside of raw machine assembler
turned out to be dangerous, because it cannot be used without exporting
which in turn computes the RPO of the schedule.

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1475643002

Cr-Commit-Position: refs/heads/master@{#32216}

Revert of Add test to check PRNG quality. (patchset #3 id:40001 of https://codereview.chromium.org/1467133006/ )

Reason for revert:
[Sheriff] Times out on arm:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim/builds/6202/steps/Check/logs/RandomBitCorrelations

Original issue's description:
> Add test to check PRNG quality.
>
> Credits go to Erik Corry. Taken from:
> https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc
>
> R=jkummerow@chromium.org
> BUG=v8:4566
> LOG=N
>
> Committed: https://crrev.com/1a90af55d1e9d7d84e813dc367d475457c7df1ff
> Cr-Commit-Position: refs/heads/master@{#32211}

TBR=jkummerow@chromium.org,erikcorry@google.com,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4566

Review URL: https://codereview.chromium.org/1473613002

Cr-Commit-Position: refs/heads/master@{#32215}

BUG=chromium:534332
LOG=n

Review URL: https://codereview.chromium.org/1468093004

Cr-Commit-Position: refs/heads/master@{#32214}

BUG=

Review URL: https://codereview.chromium.org/1407313004

Cr-Commit-Position: refs/heads/master@{#32213}

BUG=

Review URL: https://codereview.chromium.org/1441043002

Cr-Commit-Position: refs/heads/master@{#32212}

Credits go to Erik Corry. Taken from:
https://github.com/dart-lang/fletch/blob/master/src/shared/random_test.cc

R=jkummerow@chromium.org
BUG=v8:4566
LOG=N

Review URL: https://codereview.chromium.org/1467133006

Cr-Commit-Position: refs/heads/master@{#32211}

BUG=v8:4305
LOG=N

Review URL: https://codereview.chromium.org/1434523002

Cr-Commit-Position: refs/heads/master@{#32210}

Makes it possible for the the inline allocation observers to be sample the
actual object allocation on which the notification triggers.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1460063006

Cr-Commit-Position: refs/heads/master@{#32209}

'this' is a raw pointer and can be invalidated through GC, even
though the rest of the code is correctly handlified.

R=cbruni@chromium.org, jkummerow@chromium.org
BUG=v8:4570
LOG=N

Review URL: https://codereview.chromium.org/1475633002

Cr-Commit-Position: refs/heads/master@{#32208}

Put the constant parts of the CreateLiteralArray and CreateLiteralObject
operators into CreateLiteralParameters and properly use them everywhere.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1475613002

Cr-Commit-Position: refs/heads/master@{#32207}

BUG=v8:4566
LOG=N

Committed: https://crrev.com/2755c5a1b1cf7fc4c5c614378e5231636e6dcff5
Cr-Commit-Position: refs/heads/master@{#32200}

Review URL: https://codereview.chromium.org/1464303002

Cr-Commit-Position: refs/heads/master@{#32206}

The literal index is being pushed onto the stack while evaluating
the non-constant subexpressions, but never used in fullcodegen (and
hence not used in the optimizing compilers).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1471893003

Cr-Commit-Position: refs/heads/master@{#32205}

TBR=ulan@chromium.org
BUG=v8:4570
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1466373003

Cr-Commit-Position: refs/heads/master@{#32204}

This passes the new.target value in a register instead of through a
side-channel via the construct stub. Note that only TurboFan code uses
the register value so far, but unoptimized code will be switched soon.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1460503008

Cr-Commit-Position: refs/heads/master@{#32203}

Revert of Implement xorshift128+ for Math.random. (patchset #6 id:100001 of https://codereview.chromium.org/1464303002/ )

Reason for revert:
Test failure: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/491/steps/Mjsunit/logs/reflect-own-keys

Original issue's description:
> Implement xorshift128+ for Math.random.
>
> BUG=v8:4566
> LOG=N
>
> Committed: https://crrev.com/2755c5a1b1cf7fc4c5c614378e5231636e6dcff5
> Cr-Commit-Position: refs/heads/master@{#32200}

TBR=bmeurer@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4566

Review URL: https://codereview.chromium.org/1475493003

Cr-Commit-Position: refs/heads/master@{#32202}

The option --json-output will make the auto-roller dump a
json file with a monitoring_state key. This can be one of:
started, up_to_date, success.

BUG=chromium:559141
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1465413002

Cr-Commit-Position: refs/heads/master@{#32201}

BUG=v8:4566
LOG=N

Review URL: https://codereview.chromium.org/1464303002

Cr-Commit-Position: refs/heads/master@{#32200}

Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )

Reason for revert:
[Sheriff] This breaks ignition on arm sim debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317

Seems to not be caught by the cq bot that builds release with dchecks.

Original issue's description:
> Disable non-standard Promise functions in staging
>
> This patch removes Promise functions and methods which are absent
> from the ES2015 specification when the --es-staging flag is on.
>
> BUG=v8:3237
> R=rossberg
> LOG=Y
>
> Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> Cr-Commit-Position: refs/heads/master@{#32194}

TBR=rossberg@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1473603002

Cr-Commit-Position: refs/heads/master@{#32199}

We use comparisons with the_hole to implement temporal dead zones, so we
should also optimize those, as they currently turn into CompareIC calls.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1473593002

Cr-Commit-Position: refs/heads/master@{#32198}

  port 374b6ea2 (r32172)

  original commit message:
  There's no point in collecting feedback for super constructor calls,
  because in all (interesting) cases we can gather (better) feedback from
  other sources (i.e. via inlining or via using a LOAD_IC to get to the
  [[Prototype]] of the target).  So CallConstructStub is now only used
  for new Foo(...args) sites where we want to collect feedback in the
  baseline compiler.  The optimizing compilers, Reflect.construct and
  super constructor calls use the Construct builtin directly, which allows
  us to remove some weird code from the CallConstructStub (and opens the
  possibility for more code sharing with the CallICStub, maybe even going
  for a ConstructICStub).

  Also remove the 100% redundant HCallNew instruction, which is just a
  wrapper for the Construct builtin anyway (indirectly via the
  CallConstructStub).

  Drive-by-fix: Drop unused has_function_cache bit on Code objects.

BUG=

Review URL: https://codereview.chromium.org/1471193002

Cr-Commit-Position: refs/heads/master@{#32197}

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1468373002

Cr-Commit-Position: refs/heads/master@{#32196}

This CL also fixes HeapObject::IterateFast() and HeapObject::IterateBodyFast().

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1469883002

Cr-Commit-Position: refs/heads/master@{#32195}

This patch removes Promise functions and methods which are absent
from the ES2015 specification when the --es-staging flag is on.

BUG=v8:3237
R=rossberg
LOG=Y

Review URL: https://codereview.chromium.org/1469543003

Cr-Commit-Position: refs/heads/master@{#32194}

This replaces chromium_roll and the wrapper auto_roll with
just auto_roll. The arguments for the revision to roll and
the last rolled revision are optional and will be
auto-detected (this feature is from the wrapper).

Checking the cq box is default now (as in the wrapper).

BUG=chromium:559141
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1468973002

Cr-Commit-Position: refs/heads/master@{#32193}

  port c1e7c8d9 (r32171)

  original commit message:
  This ensures that the ArgumentsAdaptorTrampoline does not clobber the
  new.target value, but rather passes it through to the callee unaltered.
  Note that callees do not yet use the new.target value so far.

  This is a preparatory CL to allows us passing new.target in a register
  instead of via a side-channel through the construct stub frame.

BUG=

Review URL: https://codereview.chromium.org/1475523002

Cr-Commit-Position: refs/heads/master@{#32192}

Add support for using inline allocations for arrays in lowering of
JSCreateArray when target equals new.target.  Currently we are only
concerend with the straight-forward Array() and Array(length) cases,
but at some point TurboFan should also be able to support the more
complex initializing cases.

R=mvstanton@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1465203002

Cr-Commit-Position: refs/heads/master@{#32191}

Rolling v8/tools/clang to 71b766acbd4f2dbe860bcb57c003eba006244ae9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1468333002

Cr-Commit-Position: refs/heads/master@{#32190}