Port 6470ddad

On MIPS different signaling NaN values must be used for hardware and simulator targets, even at snapshot generation when always simulator is used.

Original commit message:
This introduces SilenceNaN operator, which makes sure that we only
store quiet NaNs into holey arrays. We omit the NaN silencing code
at instruction selection time if the input is an operation that
cannot possibly produce signalling NaNs.

BUG=

Review-Url: https://codereview.chromium.org/2171303002
Cr-Commit-Position: refs/heads/master@{#38030}

On AIX clock_gettime provides CPU time with a resolution of
10ms, which causes the ThreadTicks testcase to fail since at
the 2 instances the CPU time of the thread outputs to 0.
Using AIX's API thread_cputime instead which provides CPU
time with a resolution of 1ns.
The testcase was added as part of https://codereview.chromium.org/1976603005

R=jochen@chromium.org, lpy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2174003002
Cr-Commit-Position: refs/heads/master@{#38029}

The testcase allocates JSArraybuffer on 2 separate pages which should be
on the New space. In the testcase semi space size is set to 2MB.
Since page size on PPC is 4MB the semi new space size defaults to 4MB.
Therefore when allocating 2nd buffer, scavenge GC kicks in as from-space is
filled up and copies 1st buffer to to-space. Now, the 2nd buffer also gets
allocated on the same to-space, therefore both buffer end up being on the
same page. This fix should allocate enough semi new space to contain 2
pages (for all platform).
The testcase was added as part of https://codereview.chromium.org/2036643002

R=mlippautz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2167853002
Cr-Commit-Position: refs/heads/master@{#38028}

/ also selects the search box.

BUG=

Review-Url: https://codereview.chromium.org/2169053002
Cr-Commit-Position: refs/heads/master@{#38027}

The tests array-concat-revoked-proxy-*.js are copied out from array-concat.js,
in order to verify that they work correctly with a valid ArrayProtector cell.

These tests pass with https://crrev.com/122a9b7af02606dae558336082ab139a87eba39d
applied, but fail without it.

BUG=v8:5134
R=neis@chromium.org, cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2177903002
Cr-Commit-Position: refs/heads/master@{#38026}

BUG=
R=danno

Review-Url: https://codereview.chromium.org/2169043002
Cr-Commit-Position: refs/heads/master@{#38025}

If you dragged the node out of the bounding box, this commit allows you to see
it again after you zoom. The zoom looks jittery, but I think it's better than
not being able to see it at all.

BUG=
R=danno

Review-Url: https://codereview.chromium.org/2168713005
Cr-Commit-Position: refs/heads/master@{#38024}

Rolling v8/build to bd9b7568ac244046c38f6c27d686d7661bfd4d27

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2178803003
Cr-Commit-Position: refs/heads/master@{#38023}

Failure is due to different endianness on big endian. The test now passes on
both big-endian and little-endian architectures.

TEST=cctest/test-code-stubs-mips64/ConvertDToI
BUG=

Review-Url: https://codereview.chromium.org/2157373002
Cr-Commit-Position: refs/heads/master@{#38022}

For GYP build, V8 configures gtest and gmock in its //testing, and OTOH for
GN build, it imports BUILD.gn from chromium and uses other configurations
from its own. However, a recent chromium change on the BUILD.gn requires
//testing update too. That prevents //build roll of V8.

BUG=chromium:630299

Review-Url: https://codereview.chromium.org/2179743002
Cr-Commit-Position: refs/heads/master@{#38021}

This flag has been enabled by default for over a month now.

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2176143002
Cr-Commit-Position: refs/heads/master@{#38020}

ToName was always generated with a subsequent Star, fuse them.
Requires a few changes in the peephole optimizer as ToName cannot be
elided as easily, but must be replaced by Star.

BUG=v8:4280
LOG=n

Review-Url: https://codereview.chromium.org/2169813002
Cr-Commit-Position: refs/heads/master@{#38019}

BUG=chromium:619166,chromium:625155

Review-Url: https://codereview.chromium.org/2175273002
Cr-Commit-Position: refs/heads/master@{#38018}

This adds a new field to the header of every BytecodeArray which stores
the current nesting level up to which loop back edges are armed as OSR
points. The intention is to arm OSR points incrementally from outermost
to innermost until one fires (similar to OSR from FullCodegen).

R=rmcilroy@chromium.org
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2172583002
Cr-Commit-Position: refs/heads/master@{#38017}

After multiplying two integers we emit code like:

  if (result == 0) {
    if (OR_OPERATION(rhs, lhs) < 0) {
      DEOPT;
    }
  }

This CL allows us to eliminate the OR and comparison if either rhs or
lhs is a negative number, reducing the code to:

  if (result == 0) DEOPT;

BUG=

Review-Url: https://codereview.chromium.org/2167643002
Cr-Commit-Position: refs/heads/master@{#38016}

Turn the LoadElimination into a proper graph Reducer so that it can run
together with ValueNumbering and RedundancyElimination to a fixpoint
for maximum load/check elimination. This also adds initial support for
eliminating redundant LoadElement/StoreElement nodes.

BUG=v8:4930,v8:5141

Review-Url: https://codereview.chromium.org/2164253002
Cr-Commit-Position: refs/heads/master@{#38015}

BUG=chromium:630952

Review-Url: https://codereview.chromium.org/2177193002
Cr-Commit-Position: refs/heads/master@{#38014}

Fix failure in mjsunit/regress/regress-5213. When bailout happens,
the double registers are not properly loaded if exponent_type() is
INTEGER (this happens in optimized version of code only).

BUG=mjsunit/regress/regress-5213

Review-Url: https://codereview.chromium.org/2175633003
Cr-Commit-Position: refs/heads/master@{#38013}

BUG=v8:5197

Review-Url: https://codereview.chromium.org/2168273004
Cr-Commit-Position: refs/heads/master@{#38012}

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2182443002
Cr-Commit-Position: refs/heads/master@{#38011}

Move the logic for allocating the global declaration pair array
from VisitDeclarations to a later step. This is required for
concurrent bytecode generation.

This change requires adding support for reserving fixed
constant pool array entries, which can be later updated
with the value of the literal.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2167763003
Cr-Commit-Position: refs/heads/master@{#38010}

R=ishell@chromium.org,bmeurer@chromium.org
TBR=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2175233003
Cr-Commit-Position: refs/heads/master@{#38009}

Introducing machine operators early causes trouble for the typing,
truncation analysis and representation selection, so we should rather
stick to simplified operators instead. Now there's only the for-in case
left, which is not clear how we can handle this in a better way.

Drive-by-fix: Also don't introduce Int32Constant and Word32Shl in
JSTypedLowering, but use NumberConstant and proper NumberShiftLeft
operators instead.

R=jarin@chromium.org
BUG=chromium:630951

Review-Url: https://codereview.chromium.org/2182453002
Cr-Commit-Position: refs/heads/master@{#38008}

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2173403002
Cr-Commit-Position: refs/heads/master@{#38007}

Revert of [heap] Remove black pages and use black areas instead. (patchset #6 id:100001 of https://codereview.chromium.org/2160613002/ )

Reason for revert:
Suspected to cause crbug.com/630969

Original issue's description:
> [heap] Remove black pages and use black areas instead.
>
> BUG=630386
> LOG=n
>
> Committed: https://crrev.com/b008a0d5a3db80a854cb93d9c94d67bf2d780f2c
> Cr-Commit-Position: refs/heads/master@{#37967}

TBR=ulan@chromium.org,hpayer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=630386

Review-Url: https://codereview.chromium.org/2176133002
Cr-Commit-Position: refs/heads/master@{#38006}

TBR=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2177183002
Cr-Commit-Position: refs/heads/master@{#38005}

BUG=
R=danno

Review-Url: https://codereview.chromium.org/2169023002
Cr-Commit-Position: refs/heads/master@{#38004}

- Remove duplicated CSS.
- Expand landing area of upload button.
- Give the toolbox a transparent white background.
- Make the phase-select box look nicer before file load.
- Remove the margin at the top of the screen.

The height of the margin was exactly the height of span#graph-toolbox,
and due to the semantics of position:relative, space was reserved for it
at the top of div#middle.

BUG=
R=danno

Review-Url: https://codereview.chromium.org/2164373002
Cr-Commit-Position: refs/heads/master@{#38003}

Always use the BytecodeGraphBuilder when the  --turbo-from-bytecode
is enabled, assuming the function should be compiled for Ignition.
Adds a new MaybeOptimizeIgnition function to runtime-profiler
which is called if the function should be optimized from bytecode
rather than going via full-codegen.

BUG=v8:4280

Committed: https://crrev.com/9ca7db914be88e6792a88eab4a1988ee031d70c4
Review-Url: https://codereview.chromium.org/2156753002
Cr-Original-Commit-Position: refs/heads/master@{#37921}
Cr-Commit-Position: refs/heads/master@{#38002}

Skip test-run-load-store/RunUnalignedLoadStoreUnalignedAccess on ARM until
UnalignedLoad and UnalignedStore operators get implemented

NOTRY=true

Review-Url: https://codereview.chromium.org/2182433002
Cr-Commit-Position: refs/heads/master@{#38001}

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2171263002
Cr-Commit-Position: refs/heads/master@{#38000}

The third attempt never landed :). This attempt completely reworks
the logic to attempt to be clearer and more obviously correct. This
attempt also actually had unit tests written for it (see bug 625353).

R=machenbach@chromium.org
BUG=625353, 629825
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_compile_x86_dbg,android_compile_mips_dbg,android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2173343002
Cr-Commit-Position: refs/heads/master@{#37999}

This patch parametrizes AstTraversalVisitor by the actual subclass,
in a similar way as AstVisitor is parametrized.  This allows a
subclass to, e.g., override the Visit method and still use the
traversal mechanism.  It also allows the subclass to override the
specific visiting methods, without them being virtual.

This patch also removes AstExpressionVisitor, subsuming its
functionality in AstTraversalVisitor.

R=adamk@chromium.org, verwaest@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2169833002
Cr-Commit-Position: refs/heads/master@{#37998}

Exception throwing will allocate

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2173423002
Cr-Commit-Position: refs/heads/master@{#37997}

R=littledan@chromium.org
BUG=chromium:630559

Review-Url: https://codereview.chromium.org/2176613002
Cr-Commit-Position: refs/heads/master@{#37996}

The dead code elimination in SimplifiedLowering can eliminate pure nodes
if they don't have value uses. But some of those can indeed have control
inputs, i.e. Phi nodes do of course have a control input.

R=jarin@chromium.org
BUG=chromium:630923

Review-Url: https://codereview.chromium.org/2177133002
Cr-Commit-Position: refs/heads/master@{#37995}

BUG=chromium:630611

Review-Url: https://codereview.chromium.org/2177483002
Cr-Commit-Position: refs/heads/master@{#37994}

In PrependElementIndicesImpl we sort a FixedArray of indices potentially
containing HeapNumbers. During the string conversion we might trigger a GC.
This in turn might try to read a slot where we previously had a HeapNumber
but the sort sneaked a SMI in there which is not a valid pointer.

BUG=chromium:630561

Review-Url: https://codereview.chromium.org/2173653003
Cr-Commit-Position: refs/heads/master@{#37993}

Rolling v8/build to 2c67d4d74b6b3673228fab191918500a582ef3b0

Rolling v8/third_party/android_tools to e4d61eb8f463e6cb8d1e1269a15c22f7c9bbd122

Rolling v8/tools/clang to 496622ab4aaa5be7e5a9b80617013cb02f45dc87

Rolling v8/tools/mb to 0c4dc43c454f26936ddf3074ab8e9a41e3dc03a3

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2173293002
Cr-Commit-Position: refs/heads/master@{#37992}

Port ba092fb0

Original commit message:

    So far we don't have a useful way to inline Math.max or Math.min in
    TurboFan optimized code. This adds new operators NumberMax and NumberMin
    and changes the Float64Max/Float64Min operators to have JavaScript
    semantics instead of the C++ semantics that it had previously.

    This also removes support for recognizing the tenary case in the
    CommonOperatorReducer, since that doesn't seem to have any positive
    impact (and actually doesn't show up in regular JavaScript, where
    people use Math.max/Math.min instead).

    Drive-by-fix: Also nuke the unused Float32Max/Float32Min operators.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2179503003
Cr-Commit-Position: refs/heads/master@{#37991}