Fix A couple places which could cause upper 32bit corruption

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/1939763003
Cr-Commit-Position: refs/heads/master@{#35952}

Takes the SIMD runtime intrinsics as a starting point for defining TF machine operators. The rationale for omitting functions is:

 - Check functions.
 - 'FromXxxBits' functions. These are essentially casts.
 - UInt constructors. int and uint aren't distinguished in wasm.
 - Uint functions, except where their behavior is bitwise different from the Int function.

Some operators are typeless, i.e. they are the same for multiple related types, e.g. logical ops for int types, load/store for float and int types. Use a 'Simd128' prefix for these operators.

Skipped fns:

Float32x4Check
Float32x4FromInt32x4Bits
Float32x4FromUint32x4Bits
Float32x4FromInt16x8Bits
Float32x4FromUint16x8Bits
Float32x4FromInt8x16Bits
Float32x4FromUint8x16Bits

Int32x4Check
Int32x4FromUint32x4
Int32x4FromFloat32x4Bits
Int32x4FromUint32x4Bits
Int32x4FromInt16x8Bits
Int32x4FromUint16x8Bits
Int32x4FromInt8x16Bits
Int32x4FromUint8x16Bits

CreateUint32x4
Uint32x4Check
Uint32x4ExtractLane
Uint32x4ReplaceLane
Uint32x4Add
Uint32x4Sub
Uint32x4Mul
Uint32x4And
Uint32x4Or
Uint32x4Xor
Uint32x4Not
Uint32x4Equal
Uint32x4NotEqual
Uint32x4Select
Uint32x4Swizzle
Uint32x4Shuffle
Uint32x4FromInt32x4
Uint32x4FromFloat32x4Bits
Uint32x4FromInt32x4Bits
Uint32x4FromInt16x8Bits
Uint32x4FromUint16x8Bits
Uint32x4FromInt8x16Bits
Uint32x4FromUint8x16Bits

Bool32x4Check

Int16x8Check
Int16x8FromUint16x8
Int16x8FromFloat32x4Bits
Int16x8FromInt32x4Bits
Int16x8FromUint32x4Bits
Int16x8FromUint16x8Bits
Int16x8FromInt8x16Bits
Int16x8FromUint8x16Bits

CreateUint16x8
Uint16x8Check
Uint16x8ExtractLane
Uint16x8ReplaceLane
Uint16x8Add
Uint16x8Sub
Uint16x8Mul
Uint16x8And
Uint16x8Or
Uint16x8Xor
Uint16x8Not
Uint16x8Equal
Uint16x8NotEqual
Uint16x8Select
Uint16x8Swizzle
Uint16x8Shuffle
Uint16x8FromInt16x8
Uint16x8FromFloat32x4Bits
Uint16x8FromInt32x4Bits
Uint16x8FromUint32x4Bits
Uint16x8FromInt16x8Bits
Uint16x8FromInt8x16Bits
Uint16x8FromUint8x16Bits

Bool16x8Check

Int8x16Check
Int8x16FromUint8x16
Int8x16FromFloat32x4Bits
Int8x16FromInt32x4Bits
Int8x16FromUint32x4Bits
Int8x16FromInt16x8Bits
Int8x16FromUint16x8Bits
Int8x16FromUint8x16Bits

CreateUint8x16
Uint8x16Check
Uint8x16ExtractLane
Uint8x16ReplaceLane
Uint8x16Add
Uint8x16Sub
Uint8x16Mul
Uint8x16And
Uint8x16Or
Uint8x16Xor
Uint8x16Not
Uint8x16Equal
Uint8x16NotEqual
Uint8x16Select
Uint8x16Swizzle
Uint8x16Shuffle
Uint8x16FromInt8x16
Uint8x16FromFloat32x4Bits
Uint8x16FromInt32x4Bits
Uint8x16FromUint32x4Bits
Uint8x16FromInt16x8Bits
Uint8x16FromUint16x8Bits
Uint8x16FromInt8x16Bits

Bool8x16Check

Generic operators for Float, Int types:

Simd128Load
Simd128Load1
Simd128Load2
Simd128Load3
Simd128Store
Simd128Store1
Simd128Store2
Simd128Store3

Generic operators for Int types:

Simd128And
Simd128Or
Simd128Xor
Simd128Not

LOG=N
BUG=v8:4124

Committed: https://crrev.com/3831d41e4ce7b162775732cb6ac1f8139e60aa30
Cr-Commit-Position: refs/heads/master@{#35213}

Review-Url: https://codereview.chromium.org/1848433003
Cr-Commit-Position: refs/heads/master@{#35951}

    Port d1b3d426

    Original commit message:

        Further refactor the pipeline to even run the first scheduler (part of
        the effect control linearization) concurrently. This temporarily
        disables most of the write barrier elimination, but we will get back to
        that later.

        Drive-by-fix: Remove the dead code from ChangeLowering, and stack
        allocate the Typer in the pipeline. Also migrate the AllocateStub to a
        native code builtin, so that we have the code object + a handle to it
        available all the time.

    R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/1941783003
Cr-Commit-Position: refs/heads/master@{#35950}

The ECMA 402 implementation previously pushed directly to real
Arrays, which risks having observably incorrect behavior in the
presence of monkey patching. This patch uses InternalArrays instead
to avoid that hazard.

R=jshin@chromium.org,yangguo@chromium.org
BUG=chromium:604299
LOG=N

Review-Url: https://codereview.chromium.org/1923803002
Cr-Commit-Position: refs/heads/master@{#35949}

For proxy object this methods returns target value, handler object and is revoked flag.

R=yangguo@chromium.org,cbruni@chromium.org
BUG=chromium:588705
LOG=Y

Review-Url: https://codereview.chromium.org/1938663002
Cr-Commit-Position: refs/heads/master@{#35948}

Our implementation of the spec got one comparison wrong, at
step 19.d.iii (we were comparing against 'q' instead of 'p').

R=littledan@chromium.org
BUG=chromium:607566
LOG=n

Review-Url: https://codereview.chromium.org/1940643002
Cr-Commit-Position: refs/heads/master@{#35947}

It truned out we can enter nested message loop and call
SetIdle from inside the compilation in some obscure
situations. To not whitelist all the possible StateTag values,
we'd better ignore this call when not profiling as it has
no effect anyway.

This patch also reverts DCHECK change from https://codereview.chromium.org/1922703005/.

BUG=none
LOG=N

Review-Url: https://codereview.chromium.org/1936703002
Cr-Commit-Position: refs/heads/master@{#35946}

Also mark VisitSuperCallReference as unreachable, as it's handled by VisitCall.

R=mstarzinger@chromium.org
BUG=v8:4967
LOG=n

Review-Url: https://codereview.chromium.org/1929213002
Cr-Commit-Position: refs/heads/master@{#35945}

Currently GetStackSample doesn't support simulator, thus sampler is aware of
simulator, but since we are moving it out, it shouldn't have knowledge of
simulator. This patch moves the logic using simulator accessible
to Isolate::GetStackSample, so that it supports simulator.

BUG=v8:4956
LOG=n

Review-Url: https://codereview.chromium.org/1926863003
Cr-Commit-Position: refs/heads/master@{#35944}

gn builds are missing Windows manifests for d8.exe and
mksnapshot.exe. These manifests are necessary in order to get
predictable behavior on Windows.

LOG=N
BUG=602505

Review-Url: https://codereview.chromium.org/1941433002
Cr-Commit-Position: refs/heads/master@{#35943}

Previous attempt: https://codereview.chromium.org/1924403002

Review-Url: https://codereview.chromium.org/1937753002
Cr-Commit-Position: refs/heads/master@{#35942}

R=rossberg@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1937083002
Cr-Commit-Position: refs/heads/master@{#35941}

This avoids weird control flow when the bytecode generator skips dead code containing yields.

BUG=v8:4907
LOG=n

Review-Url: https://codereview.chromium.org/1927943003
Cr-Commit-Position: refs/heads/master@{#35940}

BUG=chromium:474921
LOG=n

Review-Url: https://codereview.chromium.org/1936123002
Cr-Commit-Position: refs/heads/master@{#35939}

Port d1b3d426

Original commit message:

    Further refactor the pipeline to even run the first scheduler (part of
    the effect control linearization) concurrently. This temporarily
    disables most of the write barrier elimination, but we will get back to
    that later.

    Drive-by-fix: Remove the dead code from ChangeLowering, and stack
    allocate the Typer in the pipeline. Also migrate the AllocateStub to a
    native code builtin, so that we have the code object + a handle to it
    available all the time.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4969
LOG=N

Review-Url: https://codereview.chromium.org/1941613002
Cr-Commit-Position: refs/heads/master@{#35938}

BUG=v8:4866
LOG=n
NOTRY=true
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/1939043002
Cr-Commit-Position: refs/heads/master@{#35937}

This removes the CompilationInfoWithZone class, which was used to
allocate a CompilationInfo on the C-heap. By now the CompilationJob is
the single object being allocated on the C-heap and passed between the
main thread and the compilation thread. Structs requiring destruction
can be embedded within that CompilationJob. This simplifies involved
lifetimes by coupling all lifetimes to one single object.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1930773003
Cr-Commit-Position: refs/heads/master@{#35936}

The Wasm suite reports both compile time and code size, however,
perf-to-html.py elides one of the results (compile time, in this case).

This affects the effectiveness of results reported by perf try bot runs.

This CL addresses that.

BUG=

Review-Url: https://codereview.chromium.org/1941573002
Cr-Commit-Position: refs/heads/master@{#35935}

The compilation pipeline is correctly guarding against accidental
tier-ups by now, the tests in question should no longer fail.

R=yangguo@chromium.org
BUG=v8:4961
LOG=n

Review-Url: https://codereview.chromium.org/1938983002
Cr-Commit-Position: refs/heads/master@{#35934}

BUG=chromium:608312
LOG=NO

Review-Url: https://codereview.chromium.org/1934993002
Cr-Commit-Position: refs/heads/master@{#35933}

It's present for host and simulator builds.

BUG=none
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/1941723002
Cr-Commit-Position: refs/heads/master@{#35932}

BUG=v8:4280
LOG=N
TBR=rmcilroy@chromium.org, rmcilroy@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/1934283002
Cr-Commit-Position: refs/heads/master@{#35931}

For LoadElimination we must not replace LoadField nodes with other nodes
whose types are not a subtype of the original LoadField type, as that
breaks the verifier. We already fixed that earlier for store to load
forwarding, but the fix didn't cover LoadField forwarding.

This actually still generates the correct code even w/o the fix, but
since recently fails due to stronger checking in representation
selection. So this makes clusterfuzz happy again.

R=mvstanton@chromium.org
BUG=chromium:607899
LOG=n

Review-Url: https://codereview.chromium.org/1934973002
Cr-Commit-Position: refs/heads/master@{#35930}

Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
Cr-Commit-Position: refs/heads/master@{#35924}

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35929}

This fixes the Python include path after the GYP files have been
relocated into another directory.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/1938893002
Cr-Commit-Position: refs/heads/master@{#35928}

Revert of [turbofan] Remove left-over change bits from ChangeLowering. (patchset #2 id:20001 of https://codereview.chromium.org/1941673002/ )

Reason for revert:
[Sheriff] Breaks mac gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/5821

Original issue's description:
> [turbofan] Remove left-over change bits from ChangeLowering.
>
> Now ChangeLowering is only concerned with lowering memory access and
> allocation operations, and all changes are consistently lowered during
> the effect/control linearization pass. The next step is to move the
> left over lowerings to a pass dedicated to eliminate redundant loads and
> stores, eliminate write barriers, fold and inline allocations.
>
> Also remove the atomic regions now that we wire everything into the
> effect chain properly. This is an important step towards allocation
> inlining.
>
> Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
> ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
> ChangeInt31ToTaggedSigned for consistency.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
>
> Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
> Cr-Commit-Position: refs/heads/master@{#35924}

TBR=ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1942733002
Cr-Commit-Position: refs/heads/master@{#35927}

This adds ignition to the testing variants that are run on all
bots.

Failing tests can only be skipped with the NO_IGNITION
keyword in status files. Existing expectations for the
ignition_turbofan variant are all duplicated and use the
NO_IGNITION keyword as well now.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/132c09ed619f23fb7c6d26a4e3552c703389eabd
Cr-Commit-Position: refs/heads/master@{#35865}

Review-Url: https://codereview.chromium.org/1804003002
Cr-Commit-Position: refs/heads/master@{#35926}

During ast decoding and turbofan graph construction, we explicitely pass
the byte offset for all instructions which potentially trap.
The byte offset is finally passed to the runtime function which throws
the actual error, but it is not used there yet.

The WasmGraphBuilder::Binop and Unop methods have a default value of -1
for the position, which allows for more compact code for all the
functions which assemble bigger snippets from the primitive operations.
Whenever the position is actually used for generating a trap, we
check that it is not negative.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1915123006
Cr-Commit-Position: refs/heads/master@{#35925}

Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Also remove the atomic regions now that we wire everything into the
effect chain properly. This is an important step towards allocation
inlining.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35924}

This makes sure that Compiler::EnsureDeoptimizationSupport follows the
same limitations as other compilation functions that trigger a tier-up.
Specifically it prevents against tier-up while inlining when activations
are present on the stack.

R=yangguo@chromium.org
BUG=chromium:607494
LOG=n

Review-Url: https://codereview.chromium.org/1917193007
Cr-Commit-Position: refs/heads/master@{#35923}

BUG=chromium:607461
R=machenbach@chromium.org,brettw@chromium.org
LOG=n

Review-Url: https://codereview.chromium.org/1927893002
Cr-Commit-Position: refs/heads/master@{#35922}

When exporting `shared-library` in profile log, additionally export a
slide offset. This is required to parse profile logs generated on
systems with ASLR (OS X), otherwise it is impossible to assign C++
symbol names to their addresses in the log.

See: https://github.com/nodejs/node/issues/6466

BUG=

Review-Url: https://codereview.chromium.org/1934453003
Cr-Commit-Position: refs/heads/master@{#35921}

It is unsound to look at the types in the TurboFan graphs after the
representation selection (and early optimization) phases, because

 (a) the remaining phases (might) run concurrently, and
 (b) the types may not be accurate (or even correct) after
     representation selection due to the way we deal with
     truncations.

So in Debug builds we now explicitly remove all types from the nodes
right after we uninstall the Typer decorator from the Graph, so any
further attempt to access the Type of a Node will lead to a crash (again
in Debug only for now).

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
BUG=v8:4969
LOG=n

Review-Url: https://codereview.chromium.org/1937803002
Cr-Commit-Position: refs/heads/master@{#35920}

Rolling v8/tools/clang to a14766ac344d97871f75e60c4dd39385a6cd2865

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/1936953003
Cr-Commit-Position: refs/heads/master@{#35919}

Further refactor the pipeline to even run the first scheduler (part of
the effect control linearization) concurrently. This temporarily
disables most of the write barrier elimination, but we will get back to
that later.

Drive-by-fix: Remove the dead code from ChangeLowering, and stack
allocate the Typer in the pipeline. Also migrate the AllocateStub to a
native code builtin, so that we have the code object + a handle to it
available all the time.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
R=mstarzinger@chromium.org
BUG=v8:4969
LOG=n

Review-Url: https://codereview.chromium.org/1926023002
Cr-Commit-Position: refs/heads/master@{#35918}

Revert of Stop using deprecated hash_map in vtune-jit.cc. (patchset #1 id:1 of https://codereview.chromium.org/1924403002/ )

Reason for revert:
Breaks vtune-jit build, see https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20vtunejit/builds/10670

Original issue's description:
> Stop using deprecated hash_map in vtune-jit.cc.
>
> Fixes https://github.com/nodejs/node/issues/6422.

TBR=jochen@chromium.org,info@bnoordhuis.nl,ben@strongloop.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1940693002
Cr-Commit-Position: refs/heads/master@{#35917}

Fixes https://github.com/nodejs/node/issues/6422.

Review-Url: https://codereview.chromium.org/1924403002
Cr-Commit-Position: refs/heads/master@{#35916}

Rolling v8/build to 5fbb07a2443f8095963594c2f365f99bad549180

Rolling v8/tools/clang to 0e474b23030b2723dfb3dd0c038746ec2c042469

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/1941543002
Cr-Commit-Position: refs/heads/master@{#35915}

Restrict the use of the `await` token as an identifier when parsing
source text as module code.

From
http://www.ecma-international.org/ecma-262/6.0/#sec-future-reserved-words:

> 11.6.2.2 Future Reserved Words
>
> The following tokens are reserved for used as keywords in future
> language extensions.
>
> Syntax
>
>     FutureReservedWord ::
>         enum
>         await
>
> await is only treated as a FutureReservedWord when Module is the goal
> symbol of the syntactic grammar.

BUG=v8:4767
LOG=N
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/1723313002
Cr-Commit-Position: refs/heads/master@{#35914}

AIX returns NULL rather than a valid heap address.

TEST=cctest/test-run-wasm-module/Run_WasmModule_CallAdd_rev
R=titzer@chromium.org, jochen@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1934633002
Cr-Commit-Position: refs/heads/master@{#35913}