This is a reland of 22d894c8
Original change's description:
> [turbofan] Add simplified operator for String.prototype.codePointAt
> 
> This CL adds the simplified operators
>   StringCodePointAt
>   SeqStringCodePointAt
> and associated lowering.
> 
> Bug: v8:7270
> Change-Id: I5aeefddeec39c3119b2d225e92a3116f802e7b45
> Reviewed-on: https://chromium-review.googlesource.com/861789
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50547}

Bug: v8:7270
Change-Id: Ia08d18543fc165fc2312cd393ed51f4ec98d7a58
Reviewed-on: https://chromium-review.googlesource.com/866311Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50599}

TBR=yangguo@chromium.org
NOTRY=true

Bug: v8:7302
Change-Id: Ica0f28fc8ce8184ffe8f51d940a77710e98b5d5a
Reviewed-on: https://chromium-review.googlesource.com/867039Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50598}

This adds testing configs to the V8 side, so that they can be deleted on the
infra side in a follow up.

TBR=yangguo@chromium.org
NOTRY=true

Bug: v8:7302
Change-Id: I93e65576b9799675ea0a8beca188c84a30695de3
Reviewed-on: https://chromium-review.googlesource.com/867037Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50597}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9e6dcff..cd91c99

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/bac35f5..7854862

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I33f454829dc255215cd9e3063d586c93c2f122af
Reviewed-on: https://chromium-review.googlesource.com/867534
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50596}

Bug: 
Change-Id: Icf0c43ef5bd3b3d3055d9606f22d3126b31016e3
Reviewed-on: https://chromium-review.googlesource.com/866930
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50595}

R: hpayer@chromium.org
No-try: true
Bug: v8:7266
Change-Id: Icc8f254d4f4e7c220cc322b3c98749da5e5ea3e6
Reviewed-on: https://chromium-review.googlesource.com/866831
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50594}

R=joransiu@ca.ibm.com, mtrofin@chromium.org, jbarboza@ca.ibm.com

Bug: 
Change-Id: I89fc3ef038310fa98e957407b44ed524b4f313bd
Reviewed-on: https://chromium-review.googlesource.com/818155Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#50593}

Record seperate virtual instance types for boilerplates and their properties
and elements. This CL adds:
- BOILERPLATE_PROPERTY_ARRAY_TYPE
- BOILERPLATE_NAME_DICTIONARY_TYPE
- BOILERPLATE_ELEMENTS_TYPE


Bug: v8:7266
Change-Id: I2e6643d4bf067aa52eb1950a696b6535b020b097
Reviewed-on: https://chromium-review.googlesource.com/867059
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50592}

No-try: true
Bug: v8:7266
Change-Id: I981ac5b4be6117bcc46383d033d639cc3b30b617
Reviewed-on: https://chromium-review.googlesource.com/867371Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50591}

The (numbing) repetition in these tests were leading to errors when
writing new tests. Now a function DefineHigherOrderTests() can be
used to succinctly describe a test on (mostly) a single line.

Change-Id: I70d65ffd784a17bbf0b9ca2de477135c5d901794
Reviewed-on: https://chromium-review.googlesource.com/864144
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50590}

Bug: chromium:802040
Change-Id: I887a6e9d06bd1e66e0e8175a7bbb830f693e55ed
Reviewed-on: https://chromium-review.googlesource.com/866854Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50589}

Bug: 
Change-Id: Ic1b6dc6fcd8bfc4f0c3dbb101a38106aa3596a12
Reviewed-on: https://chromium-review.googlesource.com/863886
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50588}

Visualizes --trace-gc-object-stats output.

No-try: true
Bug: v8:7266
Change-Id: I5beb15d63e645484f07fe5f2341105c4cfe0b550
Reviewed-on: https://chromium-review.googlesource.com/860580
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50587}

At the moment the slot index is encoded in the opcode. This, however,
sets an upper limit the slot index which is lower than what we want to
have (i.e. < 512). With this change we pass the slot index as an
immediate operand, which does not impose limits on the value it
contains.

R=titzer@chromium.org

Change-Id: Iab676186f41b8174bcc6c5a6053e6b0d5640ed3c
Reviewed-on: https://chromium-review.googlesource.com/866721
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50586}

This is the implementation of crrev.com/c/766371 for arm64.

Original description:

Add the ability to return (multiple) return values on the stack:

- Extend stack frames with a new buffer region for return slots.
  This region is located at the end of a caller's frame such that
  its slots can be indexed as caller frame slots in a callee
  (located beyond its parameters) and assigned return values.
- Adjust stack frame constructon and deconstruction accordingly.
- Extend linkage computation to support register plus stack returns.
- Reserve return slots in caller frame when respective calls occur.
- Introduce and generate architecture instructions ('peek') for
  reading back results from return slots in the caller.
- Aggressive tests.
- Some minor clean-up.

R=v8-arm-ports@googlegroups.com

Change-Id: I6e344a23f359861c9a1ff5a6511651c2176ce9a8
Reviewed-on: https://chromium-review.googlesource.com/842545Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50585}

Also sort all variants in configuration mapping.

Bug: v8:7285
Change-Id: I2d3032b911e48c34557e47e50345fb29da7bbe85
Reviewed-on: https://chromium-review.googlesource.com/866502Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50584}

On Arm64, the 31 encoding refers to either the zero register or the stack
pointer depending on the instruction. However, in order to distinguish them in
the assembler, the stack pointer has an internal code which isn't 31.

As a result, we need to use the internal code when converting a Register to a
DWARF code.

Bug: v8:6644
Change-Id: If8a6b6c94badd7d10c22664c7081733258b07a31
Reviewed-on: https://chromium-review.googlesource.com/866870Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50583}

Bug: v8:7264
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I0c07c92955c0b6c145c7b72e5014f828eaf59c9a
Reviewed-on: https://chromium-review.googlesource.com/865903Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50582}

This fixes a corner-case in the {NativeModuleSerializer} with modules
that do not contain any functions in the code table.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-801850
BUG=chromium:801850

Change-Id: I30cc3a26f30d8653fba2d7b99715830d12300ac2
Reviewed-on: https://chromium-review.googlesource.com/866773Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50581}

Change-Id: Idae3ceb3f8de79ab94ccaa1961d025242a51714d
Reviewed-on: https://chromium-review.googlesource.com/866715Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50580}

Change-Id: Ic434384f1f7d14c7117db2f5f42be36a1e861ef4
Reviewed-on: https://chromium-review.googlesource.com/866744Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50579}

- Remove CSA fallback to runtime for overlap cases
- Move overlap handling from runtime into elements.cc

Depending on typed array size (and overlap size), quick measurements
show a 4.3x - 8x improvement.  This fixes large >5x performance
cliff between overlap and non-overlap cases.
https://github.com/peterwmwong/v8-perf/blob/master/typedarray-set-overlap-fast-c-call/README.md

Bug: v8:5929
Change-Id: I47758d2ee603bc26f38dd9112567113cf887f5d5
Reviewed-on: https://chromium-review.googlesource.com/846378Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50578}

This will add three gc fuzzing flags with 5% likelihood each to the second
correctness fuzzing config. The random checks are determined by the
top-level random-seed passed to the script.

This change depends on setting the fuzzer random seed as default to the
standard random seed, since the former isn't explicitly passed by
clusterfuzz.

NOTRY=true
TBR=hpayer@chromium.org

Bug: v8:7012
Change-Id: I794dc48bb953b6a95bbc4fc4305ad561bc13b6ee
Reviewed-on: https://chromium-review.googlesource.com/865912Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50577}

Bug: v8:6917
Change-Id: I5136f183bd1728a1ab90a9ebb2560d978e17ef28
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/863623
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50576}

R=ulan@chromium.org

Bug: v8:7303
Change-Id: Ica6db623fbb5a4c4dd3ccf1dcbd6f796bb4406fc
Reviewed-on: https://chromium-review.googlesource.com/865907Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50575}

On arm64, the stack pointer has to be aligned all the time. This
alignment was not considered in the creation of the CallDescriptor in
the fuzzer and thereby caused a mismatch between the CallDescriptor and
code generator. In other words, a callee put return values in a stack
slot which was different than the stack slot where the caller expected
the return value.

With this CL we consider this alignment in the fuzzer.

R=clemensh@chromium.org

Change-Id: I8c78c24c682b7b8678c0d4d112bae99cf405b184
Reviewed-on: https://chromium-review.googlesource.com/864682Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50574}

Bug: v8:6917
Change-Id: Iab4e9d7a8f8a4313a6722610fb6a2cfcff703d81
Reviewed-on: https://chromium-review.googlesource.com/866710Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50573}

Mixing SSE and AVX instructions can cause severe slowdowns, so always
use AVX instructions if available.
The {Movss} method of {TurboAssembler} automatically does this,
emitting either {vmovss} or {movss}.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I45124944964e5a970814c7b50dfbfca333137dc1
Reviewed-on: https://chromium-review.googlesource.com/865910Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50572}

Remove SetStackPointer function and update assembler tests.

Bug: v8:6644
Change-Id: I5ea26e57b848d56433c84d8eea22d7e9b761e6bb
Reviewed-on: https://chromium-review.googlesource.com/864147Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50571}

Every JS function has a bailout check at the beginning which makes sure it was
not lazily deoptimized. We can improve the check slightly:

- Load the code data container directly with a pc-relative load instead of
  ADR+LDR.
- Check the deoptimization bit with TBZ directly, saving us a TST instruction.
- Use one of the macro-assembler's dedicated scratch registers instead of x2.

Bug: 
Change-Id: Iea4824c74ed5a01b18595d5e980788f9745bbb6e
Reviewed-on: https://chromium-review.googlesource.com/864446Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50570}

If a NumberConstant can be represented as a Smi, then lower it to a
IntPtrConstant node during simplified lowering. Thanks to this, all backends can
match Smi values that can also be encoded as immediates in the instruction
selector. Additionally, we can apply the same lowering to the CodeAssembler for
the snapshot.

As a result, we can remove `mov` instructions generated because Int32Matcher and
Int64Matcher didn't not recognize Smis:

For 32-bit target, it's common for Smis also be immediates: "if (a < 100) {}"
~~~
mov r1, #200 -> cmp r0, #200
cmp r0, r1   -> blt <>
blt <>       ->
~~~

On Arm64 particularly, we lose opportunites to use `cbz`: "if (a == 0) {}"
~~~
movz x0, #0x0 -> cbz x1 <>
cmp x1, x0    ->
b.eq <>       ->
~~~

Overall, we do not see an impact on benchmarks such as webtooling. However, we
do see noteworthy code size reduction, from 0.5% to 1.5%.

Bug: 
Change-Id: I7fbb718ad51b9036c3514fa31c1326bdd6f2b0e6
Reviewed-on: https://chromium-review.googlesource.com/848814Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50569}

Instead of passing four arguments to the runtime function, just pass
one pointer to a struct containing all information. This makes it much
easier to implement memory tracing in Liftoff in a follow-up CL.
Also fix a few other minor things like the namespace and the include
guards.

R=titzer@chromium.org

Change-Id: I47d8827cbb896a581585947f594af52f42bdb37c
Reviewed-on: https://chromium-review.googlesource.com/863673Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50568}

Fix wrong MacroAssembler instruction in
kArchCallWasmFunction, which caused over
1000 tests to fail.

Bug: 
Change-Id: I5730f33ec2253d2d5dfaf8a8e6d5414f0668b4bd
Reviewed-on: https://chromium-review.googlesource.com/866498Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50567}

The fast variants set got the same as no variants after crankshaft
deprecation and there is no plan to extend it again. Hence we remove
the modifier now.

TBR=yangguo@chromium.org

Bug: v8:7264
Change-Id: Ib577542741841b5b9542327b90afea8d5a62c879
Reviewed-on: https://chromium-review.googlesource.com/866496Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50566}

Bug: v8:6917
Change-Id: Id73e4892a0d1b3b9c5bdd70ccc136e7bd2edf360
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/863603
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50565}

TBR=mvstanton@chromium.org

Bug: v8:4495
Change-Id: I8a8beb85ec7e28ca98504d811542dff1fced25dc
Reviewed-on: https://chromium-review.googlesource.com/865897Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50564}

For JSCreate nodes with constant inputs we cannot simply assume that the
new.target input is a JSFunction, since it can essentially be any
JSReceiver that is a constructor, i.e. it can also be a JSBoundFunction.

Bug: chromium:801627
Change-Id: Ia37bf9c0a751e4665e1167a3771fbe166473c979
Reviewed-on: https://chromium-review.googlesource.com/866493Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50563}

This moves the funky conditional code in ScheduleAndSelectInstructions to
the caller (the caller mostly knows statically what it wants).

My hidden agenda is to prepare the pipeline for post-scheduling passes.

Change-Id: Ia6009a6b2472d7211ef213eb4eb551957ae9709c
Bug: v8:5267
Reviewed-on: https://chromium-review.googlesource.com/863663
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50562}

This reverts commit 42667bab.

Reason for revert: Breaks msvc compile:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/908

Original change's description:
> Simplify FunctionKind, saving 4 bits in SharedFunctionInfo
> 
> Since we only need to store 18 different function kinds,
> the bitfield approach was wasting space (requiring 11 bits).
> 
> This patch replaces the bitfield with a regular enum, and
> updates all the FunctionKind predicates to use comparisons
> instead of bitwise ops.
> 
> For the small amount of builtin code that depended upon being
> able to do masking to determine whether something is a class
> constructor, we still store two extra bits on FunctionKind,
> which are computed when the SFI is initialized.
> 
> If this approach causes performance regressions (i.e., if it
> turns out that other code was implicitly depending on masking
> for fast checks), we can revert this or address it in
> other ways (e.g., by doing similar caching of repeated checks
> in the caller).
> 
> Change-Id: Iebb3214f564ea8bd7b21e78fda33517d63247124
> Reviewed-on: https://chromium-review.googlesource.com/860896
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50559}

TBR=adamk@chromium.org,gsathya@chromium.org

Change-Id: I8e1faa0ca6213d1e70a00fcb417b1bfa35ebd643
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/866310Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50561}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/28d46dd..9e6dcff

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/d3ad6b3..6fe4a32

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/30e5a9f..bac35f5

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ia978edcec12aab14d330afad6c811047cf622260
Reviewed-on: https://chromium-review.googlesource.com/866171
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50560}