Adds an evacuation mode that allows moving pages within new space without
copying objects.

Basic idea:
a) Move page within new space
b) Sweep page to make iterable and process ArrayBuffers
c) Finish sweep till next scavenge

Threshold is currently 70% live bytes, i.e., the same threshold we use
to determine fragmented pages.

BUG=chromium:581412
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/1957323003
Cr-Commit-Position: refs/heads/master@{#36990}

Revert of [turbofan] Stage binop type feedback. (patchset #1 id:1 of https://codereview.chromium.org/2059403003/ )

Reason for revert:
Blows up on the waterfall.

Original issue's description:
> [turbofan] Stage binop type feedback.
>
> Committed: https://crrev.com/28fbec405548c43088cade1cd17d8407ca948a21
> Cr-Commit-Position: refs/heads/master@{#36988}

TBR=mvstanton@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2066193002
Cr-Commit-Position: refs/heads/master@{#36989}

Review-Url: https://codereview.chromium.org/2059403003
Cr-Commit-Position: refs/heads/master@{#36988}

If JSAdd or JSSubtract has number feedback, there's no benefit to use
the speculative versions of NumberAdd and/or NumberSubtract. Relying on
the existing operators gives us some nice truncations instead, so let's
stick to that for now.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2063073004
Cr-Commit-Position: refs/heads/master@{#36987}

Named capture groups may be specified using the /(?<name>pattern)/u
syntax, with named backreferences specified as /\k<name>/u. They're
hidden behind the --harmony-regexp-named-captures flag, and are only
enabled for unicode regexps.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2050343002
Cr-Commit-Position: refs/heads/master@{#36986}

The Vector type is deprecated, and new code should use ZoneVector
instead. This new overload of NewStringFromTwoByte will be used in an
upcoming regexp CL.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2065053002
Cr-Commit-Position: refs/heads/master@{#36985}

Now that we have the PlainPrimitiveToNumber operator(s), we can unify
all the places where we expect a number, but can also safely handle any
plain-primitive (via ToNumber truncation).

Drive-by-fix: Also handle Math.min consistently with Math.max.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2064953004
Cr-Commit-Position: refs/heads/master@{#36984}

Rolling v8/build to 696616b539a8ab8cf400a4cfaead772154c6645c

Rolling v8/tools/clang to 792bfbf9f3126cb51eddd5c6f2f9e9a67393687b

Rolling v8/tools/mb to 5c0ee173872849b18b0837590c094a8579bc0013

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2064113003
Cr-Commit-Position: refs/heads/master@{#36983}

  The last 4 test cases in test/cctest/wasm/test-run-wasm-asmjs.cc added by the CL 36911 (https://codereview.chromium.org/2061583002) use float_t and double_t type for WasmRunner.
  For examples: At line 249: WasmRunner<float_t> r(&module, MachineType::Uint32());

  But float_t and double_t depends on FLT_EVAL_METHOD macro of compiler. FLT_EVAL_METHOD is variant on different platform, if the FLT_EVAL_METHOD is 2,  both float_t and double_t will be long
  double and gcc or clang will met error when compiling   WasmRunner<long double> r(&module,MachineType::Uint32());

  For more details, please refer:
  float_t: http://www.cplusplus.com/reference/cmath/float_t/
  FLT_EVAL_METHOD: https://en.wikipedia.org/wiki/C99 check the IEEE 754 floating point support section directly.

  This CL used float and double to replace float_t and double_t to avoid this issue.

BUG=

Review-Url: https://codereview.chromium.org/2066703003
Cr-Commit-Position: refs/heads/master@{#36982}

Port 6470ddad

Original commit message:

    This introduces SilenceNaN operator, which makes sure that we only
    store quiet NaNs into holey arrays. We omit the NaN silencing code
    at instruction selection time if the input is an operation that
    cannot possibly produce signalling NaNs.

R=jarin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2069883002
Cr-Commit-Position: refs/heads/master@{#36981}

The modifications were necessary to properly represent asm types:

1) fround is no longer an overloaded function.

2) the constructor for MinMaxTypes now takes a return type.

3) Adds pseudo-types for representing the Load/Store types for fp heap views.
BUG=

Review-Url: https://codereview.chromium.org/2069443002
Cr-Commit-Position: refs/heads/master@{#36980}

Reporting use counts by invoking a callback once per occurrence has
a large overhead cost in certain situations, for example when it needs
to be dispatched to a different thread (which is the case for Web Workers).

Parsing large scripts can produce a lot of occurrences (strict/sloppy mode
once per function).

Chromium (the only known user of UseCounters so far) does not actually care
about number of occurrences, but simply whether they happened at least once.
This commit changes behavior to report features at most once, which dramatically
improves performance for impacted use cases, and should not affect the only
known real world usage.

R=littledan@chromium.org
BUG=chromium:614775

Review-Url: https://codereview.chromium.org/2062203002
Cr-Commit-Position: refs/heads/master@{#36979}

Support for relocatable globals, to facilitate compilation before
instantiation.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2062003002
Cr-Commit-Position: refs/heads/master@{#36978}

This is dead code.

Review-Url: https://codereview.chromium.org/2057193004
Cr-Commit-Position: refs/heads/master@{#36977}

Revert of Fix scope flags for default parameters (patchset #2 id:20001 of https://codereview.chromium.org/2042793002/ )

Reason for revert:
Does not fix the bug it intended to fix.

Original issue's description:
> Fix scope flags for default parameters
>
> R=rossberg,adamk
> BUG=chromium:616386
>
> Committed: https://crrev.com/4cc1331c341f5bfbeee54fec521f682a8a406af4
> Cr-Commit-Position: refs/heads/master@{#36755}

TBR=adamk@chromium.org,rossberg@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2062593002
Cr-Commit-Position: refs/heads/master@{#36976}

Revert of [turbofan] Introduce a dedicated CheckBounds operator. (patchset #5 id:80001 of https://codereview.chromium.org/2035893004/ )

Reason for revert:
Speculative revert since V8 roll is blocked.

Buildbot: https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/228171

Example log: https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/228171/steps/browser_tests%20%28with%20patch%29%20on%20Ubuntu-12.04/logs/CreateNewFolder_FileManagerBrowserTest.Test_0

Failing assert:
#
# Fatal error in ../../v8/src/compiler/node.cc, line 63
# Node::New() Error: #202:DeoptimizeUnless[1] is nullptr
#

(I take it that's a rather generic assert in TF, hence the revert is somewhat sepculative.)

Original issue's description:
> [turbofan] Introduce a dedicated CheckBounds operator.
>
> This CheckBounds simplified operator is similar to the HBoundsCheck in
> Crankshaft, and is hooked up to the new type feedback support in the
> SimplifiedLowering. We use it to check the index bounds for keyed
> property accesses.
>
> Note to perf sheriffs: This will tank quite a few benchmarks, as the
> operator makes some redundant branch elimination ineffective for
> certain patterns of keyed accesses. This does require more serious
> redundancy elimination, which we will do in a separate CL. So ignore
> any regressions from this CL, we know there will be a few.
>
> R=jarin@chromium.org
> BUG=v8:4470,v8:5100
>
> Committed: https://crrev.com/85e5567dae66a918500ae94c5568221137a0f5d4
> Cr-Commit-Position: refs/heads/master@{#36947}

TBR=jarin@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470,v8:5100

Review-Url: https://codereview.chromium.org/2064163002
Cr-Commit-Position: refs/heads/master@{#36975}

R=littledan@chromium.org, mathias@qiwi.be
BUG=v8:4743

Committed: https://crrev.com/92bfd13457c80f02be01551f4ea9a5badfe0e4c4
Review-Url: https://codereview.chromium.org/2059113002
Cr-Original-Commit-Position: refs/heads/master@{#36969}
Cr-Commit-Position: refs/heads/master@{#36974}

The trace-events will have a high overhead when turned on, but they are in a disabled-by-default category.

As long as the off overhead is negligible, this CL allows us to understand the behavior of V8 rather than its performance at the moment.

The original CL was failing the TSAN builder, the variable in question was intended to be accessed quickly with no guarantee.
Switched to using an Atomic variable with no barrier read/write.

BUG=v8:5089

patch from issue 2052523002 at patchset 100001 (http://crrev.com/2052523002#ps100001)

Review-Url: https://codereview.chromium.org/2063853002
Cr-Commit-Position: refs/heads/master@{#36973}

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2063823006
Cr-Commit-Position: refs/heads/master@{#36972}

[stubs] Ensure that StoreTransitionStub does not bailout after the properties backing store is enlarged.

In addition, this CL fixes --trace-hydrogen-stubs mode.

BUG=chromium:601420
LOG=Y

Review-Url: https://codereview.chromium.org/2068693003
Cr-Commit-Position: refs/heads/master@{#36971}

Revert of [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}. (patchset #3 id:40001 of https://codereview.chromium.org/2059113002/ )

Reason for revert:
compile failure

Original issue's description:
> [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}.
>
> R=littledan@chromium.org, mathias@qiwi.be
> BUG=v8:4743
>
> Committed: https://crrev.com/92bfd13457c80f02be01551f4ea9a5badfe0e4c4
> Cr-Commit-Position: refs/heads/master@{#36969}

TBR=littledan@chromium.org,mathias@qiwi.be
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2065083002
Cr-Commit-Position: refs/heads/master@{#36970}

R=littledan@chromium.org, mathias@qiwi.be
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2059113002
Cr-Commit-Position: refs/heads/master@{#36969}

See bug description.

BUG=chromium:619382
LOG=N
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2065063002
Cr-Commit-Position: refs/heads/master@{#36968}

Port https://codereview.chromium.org/2057053002/ for the
v8-side configurations.

BUG=chromium:616035
NOTRY=true
TBR=vogelheim@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2066823002
Cr-Commit-Position: refs/heads/master@{#36967}

This is part of the fixes required to make type feedback viable for
TurboFan on Octane.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2065953002
Cr-Commit-Position: refs/heads/master@{#36966}

The former will handle loads of predeclared global variables (vars and
functions), lets, consts and undeclared variables. The latter will handle
named loads from explicit receiver. In addition, named loads does not
depend of the TypeofMode.

TypeofMode related cleanup will be done in the follow-up CL.

BUG=chromium:576312
LOG=Y
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1912633002
Cr-Commit-Position: refs/heads/master@{#36965}

R=bmeurer@chromium.org, caitpotter88@gmail.com, neis@chromium.org
BUG=v8:5099

Review-Url: https://codereview.chromium.org/2067503002
Cr-Commit-Position: refs/heads/master@{#36964}

Moves between operands with different representations shouldn't happen,
so don't test them. This makes it easier to modify canonicalization to
differentiate between floating point types, which is needed to support
floating point register aliasing for ARM and MIPS.

This change also expands tests to include explicit FP moves (both register and stack slot).

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2060273003
Cr-Commit-Position: refs/heads/master@{#36963}

The pattern of how our source files are listed in GYP files changed,
which in turn broke the parsing pattern that GCMole uses to gather a
list of files to check. Only 'cctest' file were checked, 'src' files
were being ignored.

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2065933002
Cr-Commit-Position: refs/heads/master@{#36962}

R=mlippautz@chromium.org, yukishiino@chromium.org
BUG=chromium:617649

Review-Url: https://codereview.chromium.org/2069563002
Cr-Commit-Position: refs/heads/master@{#36961}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2068603002
Cr-Commit-Position: refs/heads/master@{#36960}

Zero value of ICStateField part made megamorphic stub cache unusable.
We need to revisit hashing algorithm in order to remove the ICStateField.

BUG=chromium:619016
LOG=N

Review-Url: https://codereview.chromium.org/2064713002
Cr-Commit-Position: refs/heads/master@{#36959}

Review-Url: https://codereview.chromium.org/2064673002
Cr-Commit-Position: refs/heads/master@{#36958}

Reland of place all remaining Oddball checks with new function (patchset #1 id:1 of https://codereview.chromium.org/2060213002/ )

Reason for revert:
Cannot reproduce gc-stress failures locally.

Original issue's description:
> Revert of Replace all remaining Oddball checks with new function (patchset #10 id:180001 of https://codereview.chromium.org/2043183003/ )
>
> Reason for revert:
> failing tests
>
> Original issue's description:
> > Replace all remaining Oddball checks with new function
> >
> > This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
> > The new method all take the isolate as parameter.
> >
> > BUG=
> >
> > Committed: https://crrev.com/ccefb3ae5fe967288d568013fb04e8761eafebc5
> > Cr-Commit-Position: refs/heads/master@{#36921}
>
> TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/33b8bc24a12fb062100c0be84456faeb0b9fa5d1
> Cr-Commit-Position: refs/heads/master@{#36923}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2059173002
Cr-Commit-Position: refs/heads/master@{#36957}

This moves common configs used by all v8 targets into
common templates.

This also fixes using v8_optimized_debug correctly in
executables and components.

BUG=chromium:474921
NOTRY=true

Review-Url: https://codereview.chromium.org/2054803003
Cr-Commit-Position: refs/heads/master@{#36956}

R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2058013002
Cr-Commit-Position: refs/heads/master@{#36955}

There's no need to have different versions of the fairly complex
TransitionElementsKindStub just to avoid a single instance type
check at execution time (which is used to figure out the effective
length in case of JSArray objects).

R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2064993002
Cr-Commit-Position: refs/heads/master@{#36954}

Port: c8ac0d86

Fix compliation failure on MIPS64 big-endian caused by typo
in implementation.

BUG=

Review-Url: https://codereview.chromium.org/2065903002
Cr-Commit-Position: refs/heads/master@{#36953}

The function name table will now always be set; a CHECK will fail if
the length would exceed the integer range.
Also, the resolution of undefined function names to "<WASM UNNAMED>" is
moved over to the wasm side.

R=titzer@chromium.org

Committed: https://crrev.com/3400ee9f4f21a455b7850ec42a4182a3c0eba310
Review-Url: https://codereview.chromium.org/2057523002
Cr-Original-Commit-Position: refs/heads/master@{#36918}
Cr-Commit-Position: refs/heads/master@{#36952}

The builtin function ID has been moved from the [function_data] field to
the [function_location] field. This just updates existing verification
functionality to be in sync.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2064723002
Cr-Commit-Position: refs/heads/master@{#36951}