bytecode graph builder

Adds implementation and tests for KeyedLoadIC, KeyedStoreIC and StoreIC to
bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1448913002

Cr-Commit-Position: refs/heads/master@{#32116}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1459783005

Cr-Commit-Position: refs/heads/master@{#32115}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1440593002

Cr-Commit-Position: refs/heads/master@{#32114}

Review URL: https://codereview.chromium.org/1461963002

Cr-Commit-Position: refs/heads/master@{#32113}

This adds an explicit parameter to the call descriptor having kind
kJSCallFunction representing the new.target value. Note that for now
this parameter is not yet passed in and hence cannot be used yet. Also
contains some refactoring of how parameter index value are calculated,
establishing Linkage as the central point for such index computations.

This is a preparatory CL to allows us passing new.target in a register
instead of via a side-channel through the construct stub frame.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1461973002

Cr-Commit-Position: refs/heads/master@{#32112}

A64 loads and stores can have much larger positive than negative
immediate offsets, and since most frame slots are below fp, we can
significantly improve accesses by basing them on sp instead. Typical
example:

    Before                  After
    mov x16, #-416
    str x20, [fp, x16]      str x20, [jssp, #32]

Notable benchmark results include lua_binarytrees, which improves by
about 7.5% on A57 and 5% on A53. Several other asm.js benchmarks gain
2-4%.

Review URL: https://codereview.chromium.org/1376173003

Cr-Commit-Position: refs/heads/master@{#32111}

This CL introduces a concept of UseInfo (but internally it still
uses machine types). The idea of UseInfo is to separate the concept
of truncation (what information is actually used by the user node)
and the concept of preferred representation. At the moment, the
truncation is (clumsily) represented by the type part of the
underlying machine type (UseInfo::type_).

Moreover, in this CL, we never specify the signedness of the use
because use signedness does not really make sense:
- if we care about the sign, it should be in the input's type
  (this is DCHECKed).
- if we do not care (e.g., trunctaing word32), then it should not
  be necessary. (And it is upto the user how it interprets the bits.)

Review URL: https://codereview.chromium.org/1462503005

Cr-Commit-Position: refs/heads/master@{#32110}

BUG=

Review URL: https://codereview.chromium.org/1463483002

Cr-Commit-Position: refs/heads/master@{#32109}

Port 1389b9f5
Port dffecf31

Implementation of two optional turbofan operators Float64RoundUp and
Float64RoundTiesEven on MIPS32. On MIPS32R2 with FP64 and MIPS32R6 with FP64
we can support these two operators directly using MIPS instructions. This
code implements these two operators. Also, added some DCHECKs for instructions
which are supported on MIPS32R2 with FP64 and MIPS32R6 with FP64 to detect
wrong usage on unsupported architectures.

BUG=

Review URL: https://codereview.chromium.org/1448383002

Cr-Commit-Position: refs/heads/master@{#32108}

If the shared function info is newly compiled when looking for
it in the script (Debug::FindSharedFunctionInfoInScript), then
we can bypass iterating the heap to find JSFunctions referencing
it (Debug::PrepareFunctionForBreakpoints).

BUG=v8:4553
LOG=N

Review URL: https://codereview.chromium.org/1454673002

Cr-Commit-Position: refs/heads/master@{#32107}

R=ishell@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/1457883003

Cr-Commit-Position: refs/heads/master@{#32106}

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1459823002

Cr-Commit-Position: refs/heads/master@{#32105}

Adds implementation and tests for LogicalNot, TypeOf and Delete operators
to bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1459543003

Cr-Commit-Position: refs/heads/master@{#32104}

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1456613002

Cr-Commit-Position: refs/heads/master@{#32103}

The ChangeFloat64ToInt64 operator changes the representation of a
float64 input value to int64 if the input value can be represented
exactly on int64. Otherwise the result is currently undefined.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1455983002

Cr-Commit-Position: refs/heads/master@{#32102}

We currently assume that all prototype maps are stable, which is
not guaranteed for certain keyed access patterns. So we explicitly
disallow optimizing the element access there for now.

BUG=chromium:557807, v8:4470
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1456973004

Cr-Commit-Position: refs/heads/master@{#32101}

Rolling v8/build/gyp to e1133480da78cd4a23a8cec604d1d6d46dab35d6

Rolling v8/buildtools to 818123dac34899ec230840936fc15b8b2b5556f9

Rolling v8/tools/clang to 650a79a0bd9b486fa688d8a71ce00674e9e2c096

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1456323002

Cr-Commit-Position: refs/heads/master@{#32100}

R=jochen@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review URL: https://codereview.chromium.org/1456923003

Cr-Commit-Position: refs/heads/master@{#32099}

This is in preparation for the addition of --harmony-destructuring-assignment.

BUG=v8:811
LOG=n

Review URL: https://codereview.chromium.org/1450193002

Cr-Commit-Position: refs/heads/master@{#32098}

BUG=chromium:524425
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel

Review URL: https://codereview.chromium.org/1461693002

Cr-Commit-Position: refs/heads/master@{#32097}

The last change to typing-asm broke non-final return statements.
Fixing this.

Finishing out a partially completed test that landed by mistake.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1453343003

Cr-Commit-Position: refs/heads/master@{#32096}

This is to re-establish a single choke point for lazy compile stubs in
preparation for CallRuntimePassFunction being changed soon.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1456003003

Cr-Commit-Position: refs/heads/master@{#32095}

BUG=chromium:555543
LOG=N

Review URL: https://codereview.chromium.org/1446343002

Cr-Commit-Position: refs/heads/master@{#32094}

BUG=

Review URL: https://codereview.chromium.org/1462573002

Cr-Commit-Position: refs/heads/master@{#32093}

post-mortem data can be useful for debugging, specially with the new llnode [1]
extensions for lldb.

[1] https://github.com/indutny/llnode

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1458583003

Cr-Commit-Position: refs/heads/master@{#32092}

Now that we no longer require AllocationInfo::limit to be aligned [1], we can do
more accurate inline-allocation-observation. This lets us get notified when the
next allocation that crosses the step-size boundary is allocated.

Fixed the test-cases. They make significantly more sense now given the step
sizes and the number of times we get notifications. For example, with a step
size of 512, an allocation of 16kb results in 32 notifications instead of 30
now.

[1] https://codereview.chromium.org/1444883003

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1448913003

Cr-Commit-Position: refs/heads/master@{#32091}

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1454103002

Cr-Commit-Position: refs/heads/master@{#32090}

Revert of Reland "[heap] Turn on parallel compaction" (patchset #1 id:20001 of https://codereview.chromium.org/1460663002/ )

Reason for revert:
Failing:
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20ASAN/builds/7903/

Original issue's description:
> Reland "[heap] Turn on parallel compaction"
>
> This reverts commit aa4688c1.
>
> BUG=chromium:524425
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel
>
> Committed: https://crrev.com/ac1d2b21bbb50572b99de4bed568437d51468e01
> Cr-Commit-Position: refs/heads/master@{#32088}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1462523002

Cr-Commit-Position: refs/heads/master@{#32089}

This reverts commit aa4688c1.

BUG=chromium:524425
LOG=N
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg;tryserver.v8:v8_linux_gc_stress_dbg;tryserver.v8:v8_mac_gc_stress_dbg;tryserver.v8:v8_linux64_msan_rel;tryserver.v8:v8_linux64_tsan_rel

Review URL: https://codereview.chromium.org/1460663002

Cr-Commit-Position: refs/heads/master@{#32088}

This fixes undefined behavior with the OpParameter helper in some of our
node matchers. There was a constness mismatch of the template parameter.

R=oth@chromium.org,mythria@chromium.org

Review URL: https://codereview.chromium.org/1453973004

Cr-Commit-Position: refs/heads/master@{#32087}

Replaces the UnboundedQueue (SP/SC) with LockedQueue (MP/MC). This is necessary
as we can have multiple tasks (on multiple platform threads) reporting code move
events.

Note that the sampling queue is not affected by this change.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1457483002

Cr-Commit-Position: refs/heads/master@{#32086}

When adding properties to the result object, that object's prototype chain should be ignored.

Review URL: https://codereview.chromium.org/1458873002

Cr-Commit-Position: refs/heads/master@{#32085}

R=bmeurer@chromium.org
BUG=chromium:554831
LOG=N

Review URL: https://codereview.chromium.org/1455883004

Cr-Commit-Position: refs/heads/master@{#32084}

This triggers TurboFan whenever functions containing spread expressions
of any kind are marked for optimization. Note that this increases the
set of functions being eligible for optimization.

R=rossberg@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1461603002

Cr-Commit-Position: refs/heads/master@{#32083}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1460583003

Cr-Commit-Position: refs/heads/master@{#32082}

This makes sure we are using the right signedness - either the input
specifies signedness or the use must declare it does not care.

This requires some hole-punching in for-in so that the
representation selector understands the smi-ness of index.
Moreover, phi needs to pass the truncation along (maybe
slightly scary).

Review URL: https://codereview.chromium.org/1455123002

Cr-Commit-Position: refs/heads/master@{#32081}

This ensures the class in question specifies the correct equality and
hashing function when instantiated. Note that this introduces two new
structs (i.e. OpEqualTo and OpHash) which can be used for defaults
within OpParameter as well.

R=titzer@chromium.org,bmeurer@chromium.org
TEST=cctest/test-operator

Review URL: https://codereview.chromium.org/1455913003

Cr-Commit-Position: refs/heads/master@{#32080}

This fixes the array literal expression stack tracking in the presence
of spread expressions. Deoptimization within a spread expression was
borked.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-deopt-in-array-literal-spread

Review URL: https://codereview.chromium.org/1455953002

Cr-Commit-Position: refs/heads/master@{#32079}

...based on the 2-lock algorithm by M. Scott and M. Michael (1992).

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1448283004

Cr-Commit-Position: refs/heads/master@{#32078}

BUG=

Review URL: https://codereview.chromium.org/1458833004

Cr-Commit-Position: refs/heads/master@{#32077}