Review URL: https://codereview.chromium.org/981203003

Cr-Commit-Position: refs/heads/master@{#28008}

Instead, views have to check their array buffer for whether
it's neutered or not.

BUG=v8:3996
R=hpayer@chromium.org,dslomov@chromium.org,verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1094863002

Cr-Commit-Position: refs/heads/master@{#27995}

Revert of track global accesses to constant types (patchset #15 id:280001 of https://codereview.chromium.org/1062163005/)

Reason for revert:
[Sheriff] Speculative revert for maybe breaking layout tests, e.g.
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2032/builds/2589

Will reland if it doesn't help.

Original issue's description:
> track global accesses to constant types
>
> BUG=

TBR=verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1094313003

Cr-Commit-Position: refs/heads/master@{#27982}

Revert of fix bad rebase in r27966 (patchset #1 id:1 of https://codereview.chromium.org/1083923005/)

Reason for revert:
Needed to revert https://chromium.googlesource.com/v8/v8/+/7bcc3d10835105fadc8ecf42a877dec479f0f80d

Original issue's description:
> fix bad rebase in r27966
>
> TBR=verwaest@chromium.org
>
> BUG=

TBR=verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1093043003

Cr-Commit-Position: refs/heads/master@{#27981}

This was a TODO for a while in crankshaft, now ready to address.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1093413002

Cr-Commit-Position: refs/heads/master@{#27976}

TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1083923005

Cr-Commit-Position: refs/heads/master@{#27970}

BUG=

Review URL: https://codereview.chromium.org/1062163005

Cr-Commit-Position: refs/heads/master@{#27966}

Baby steps towards saner #includes...

Review URL: https://codereview.chromium.org/1051393003

Cr-Commit-Position: refs/heads/master@{#27958}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1099473004

Cr-Commit-Position: refs/heads/master@{#27945}

We have a bottleneck around storing elements in the array and object prototypes,
but the Push() and Unshift() builtins don't respect them.

Fix this exactly to the level of existing support for stores.

BUG=v8:4043
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1066003003

Cr-Commit-Position: refs/heads/master@{#27943}

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1086863003

Cr-Commit-Position: refs/heads/master@{#27935}

BUG=

Review URL: https://codereview.chromium.org/1090813003

Cr-Commit-Position: refs/heads/master@{#27911}

Revert of Refactor compilation dependency handling. (patchset #4 id:60001 of https://codereview.chromium.org/1095433002/)

Reason for revert:
[Sheriff] Causes crashes in laout tests:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2543

Extra bisect run:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2548

Original issue's description:
> Refactor compilation dependency handling.
>
> Extract a new data structure CompilationDependencies and move (most) logic there.
>
> R=mstarzinger@chromium.org,verwaest@chromium.org
> BUG=
>
> Committed: https://crrev.com/b882479f1c84a48961b8aec81fa1bb1225034784
> Cr-Commit-Position: refs/heads/master@{#27892}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1093783002

Cr-Commit-Position: refs/heads/master@{#27904}

BUG=chromium:476592
LOG=n

Review URL: https://codereview.chromium.org/1086333002

Cr-Commit-Position: refs/heads/master@{#27898}

Extract a new data structure CompilationDependencies and move (most) logic there.

R=mstarzinger@chromium.org,verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095433002

Cr-Commit-Position: refs/heads/master@{#27892}

This reverts commit 8c98cc07
because it causes flaky failures in the dromaeo.jslibeventprototype
benchmark on Linux/Windows and consistent failures on Android.

Also reverts the followup "Remove kForInStatementIsNotFastCase bailout reason"
(commit ba24e676) to avoid breaking the build.

BUG=chromium:476592
TBR=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1066663005

Cr-Commit-Position: refs/heads/master@{#27859}

Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1086873003

Cr-Commit-Position: refs/heads/master@{#27857}

Ensure that we protect turning off the vector ics flag.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1087213002

Cr-Commit-Position: refs/heads/master@{#27844}

R=verwaest@chromium.org
TEST=cctest/test-api
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1058553004

Cr-Commit-Position: refs/heads/master@{#27843}

This needs "Pass load ic state through the Oracle"
(https://codereview.chromium.org/1083933002/) to land first.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1083083002

Cr-Commit-Position: refs/heads/master@{#27827}

Original issue's description:
> Remove support for thread-based recompilation
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/ed5db223a19dfe126af01
> Cr-Commit-Position: refs/heads/master@{#27619}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1087763003

Cr-Commit-Position: refs/heads/master@{#27821}

Revert of Reland "Remove support for thread-based recompilation" (patchset #1 id:1 of https://codereview.chromium.org/1059853004/)

Reason for revert:
still times out

Original issue's description:
> Reland "Remove support for thread-based recompilation"
>
> Original issue's description:
> > Remove support for thread-based recompilation
> >
> > BUG=v8:3608
> > R=yangguo@chromium.org
> > LOG=y
> >
> > Committed: https://crrev.com/ed5db223a19dfe126af012e894582251aa3635d7
> > Cr-Commit-Position: refs/heads/master@{#27619}
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/f1ceccb8b8b352a91e6366e3e3103f1db0df6afb
> Cr-Commit-Position: refs/heads/master@{#27813}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3608

Review URL: https://codereview.chromium.org/1082183003

Cr-Commit-Position: refs/heads/master@{#27816}

Original issue's description:
> Remove support for thread-based recompilation
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/ed5db223a19dfe126af012e894582251aa3635d7
> Cr-Commit-Position: refs/heads/master@{#27619}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1059853004

Cr-Commit-Position: refs/heads/master@{#27813}

BUG=chromium:388665
LOG=n

Review URL: https://codereview.chromium.org/1087463003

Cr-Commit-Position: refs/heads/master@{#27795}

Revert of VectorICs: megamorphic keyed loads in crankshaft don't need a vector. (patchset #3 id:40001 of https://codereview.chromium.org/1067573003/)

Reason for revert:
[Sheriff] Speculative revert for windows failure... will reland if it doesn't help:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug%20-%202/builds/2891

Original issue's description:
> VectorICs: megamorphic keyed loads in crankshaft don't need a vector.
>
> They are content with a dummy vector, as MISSES won't result in
> changing the real vector/slot at all.
>
> BUG=
>
> Committed: https://crrev.com/c8e4d57d3b3036a05902f5b916cb5d853a57393c
> Cr-Commit-Position: refs/heads/master@{#27788}

TBR=dcarney@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1060263003

Cr-Commit-Position: refs/heads/master@{#27790}

They are content with a dummy vector, as MISSES won't result in
changing the real vector/slot at all.

BUG=

Review URL: https://codereview.chromium.org/1067573003

Cr-Commit-Position: refs/heads/master@{#27788}

BUG=v8:4023
LOG=NO

Review URL: https://codereview.chromium.org/1081033004

Cr-Commit-Position: refs/heads/master@{#27779}

BUG=

Review URL: https://codereview.chromium.org/1075933003

Cr-Commit-Position: refs/heads/master@{#27748}

This makes sure Crankshaft respects interceptors in the global object
even when they shadow a constant global property.

R=verwaest@chromium.org
TEST=cctest/test-api-interceptors/PrePropertyHandler

Review URL: https://codereview.chromium.org/1070803002

Cr-Commit-Position: refs/heads/master@{#27733}

BUG=v8:3018
R=
LOG=N

Review URL: https://codereview.chromium.org/938443002

Cr-Commit-Position: refs/heads/master@{#27714}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1071473003

Cr-Commit-Position: refs/heads/master@{#27667}

Revert of Remove support for thread-based recompilation (patchset #1 id:1 of https://codereview.chromium.org/966653002/)

Reason for revert:
speculative revert due to gc-stress timeouts.

Original issue's description:
> Remove support for thread-based recompilation
>
> BUG=v8:3608
> R=yangguo@chromium.org
> LOG=y
>
> Committed: https://crrev.com/ed5db223a19dfe126af012e894582251aa3635d7
> Cr-Commit-Position: refs/heads/master@{#27619}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
BUG=v8:3608
LOG=N

Review URL: https://codereview.chromium.org/1063383004

Cr-Commit-Position: refs/heads/master@{#27654}

This is a follow-up to 2d281e71 and prevents bailouts on empty
script contexts in Crankshaft, which don't need allocation. Only
non-empty script contexts should cause a bailout.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1063373003

Cr-Commit-Position: refs/heads/master@{#27649}

BUG=

Review URL: https://codereview.chromium.org/1066873002

Cr-Commit-Position: refs/heads/master@{#27635}

This enables eager optimization of top-level code with TurboFan and
extends test coverage by triggering it with the --always-opt flag.
Script contexts are now also properly allocated in TurboFan.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1053063003

Cr-Commit-Position: refs/heads/master@{#27633}

BUG=v8:3608
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/966653002

Cr-Commit-Position: refs/heads/master@{#27619}

Previously, the only optimized code path for Maps and Sets was for String keys.
This was achieved through an implementation of various complex operations
in Hydrogen. This approach was neither scalable nor forward-compatible.

This patch adds the necessary intrinsics to implement Maps and Sets almost entirely
in JS. The added intrinsics are:

  %_FixedArrayGet
  %_FixedArraySet
  %_TheHole
  %_JSCollectionGetTable
  %_StringGetRawHashField

With these additions, as well as a few changes to what's exposed as runtime functions,
most of the C++ code backing Maps and Sets is gone (including both runtime code in
objects.cc and Crankshaft in hydrogen.cc).

Review URL: https://codereview.chromium.org/947683002

Cr-Commit-Position: refs/heads/master@{#27605}

Currently this only sets branch hints, so we get unlikely code "out of
the way", but in the long run the register allocator needs some love
to treat the unlikely code as, well, unlikely. :-)

Review URL: https://codereview.chromium.org/1048063002

Cr-Commit-Position: refs/heads/master@{#27540}

Review URL: https://codereview.chromium.org/1042843002

Cr-Commit-Position: refs/heads/master@{#27521}

R=verwaest@chromium.org,dslomov@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1038313004

Cr-Commit-Position: refs/heads/master@{#27518}