A future linear version of the hash table will only need the element count and
deleted element count. Hence moving them to the beginning of the underlying
fixed array makes the transition easier.

BUG=v8:5717

Review-Url: https://codereview.chromium.org/2630373002
Cr-Commit-Position: refs/heads/master@{#42459}

Power9 support was originally added in CL
https://codereview.chromium.org/2625013002

R=jochen@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2637213002
Cr-Commit-Position: refs/heads/master@{#42458}

R=machenbach@chromium.org,eholk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2641873002
Cr-Commit-Position: refs/heads/master@{#42457}

Due to outstanding performance issues, it's safer to revert these
changes.

Revert "PPC/s390: [TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "[TypeFeedbackVector] DeclareGlobals needs a literals array"
Revert "PPC/s390: [builtins] CompileLazy bailed out to the runtime entirely too often."
Revert "[builtins] CompileLazy bailed out to the runtime entirely too often."

Another CL is to follow that removes the main part of this work
(after that revert, performance regressions should disappear.

TBR=mstarzinger@chromium.org, leszeks@chromium.org, bmeurer@chromium.org
BUG=680637

Review-Url: https://codereview.chromium.org/2645543002
Cr-Commit-Position: refs/heads/master@{#42456}

Also, emit a NewWithSpread bytecode for CallNew AST nodes where possible, rather than desugaring in the parser.

BUG=v8:5511

Review-Url: https://codereview.chromium.org/2629363002
Cr-Commit-Position: refs/heads/master@{#42455}

This CL fixes the check for empty elements in keys.cc. Previously we would
accidentally bail out of the fast path because the check would always fail.
As a consequence for-in loops that would initialize the enum-cache of an object
with own-only fast properties would never be optimized properly.

Review-Url: https://codereview.chromium.org/2638323002
Cr-Commit-Position: refs/heads/master@{#42454}

Lower JSLoadMessage and JSStoreMessage in JSTypedLowering to allow for
optimizations across try-catch, try-finally, for-of, destructuring,
etc.

BUG=v8:5448
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2641843002
Cr-Commit-Position: refs/heads/master@{#42453}

Makes us pass the spec's memory.wast test.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2640453003
Cr-Commit-Position: refs/heads/master@{#42452}

Breakpoints are always re-set by the embedder after compilation, so we
don't want to store the corresponding breakpoint objects.
Also don't serialize WASM_INTERPRETER_ENTRY stubs as they are replaced
by ordinary WASM_FUNCTION code at instantiation anyway, and skip
WASM_TO_JS wrappers which are recompiled on each instantiation.
Instead, we serialize the Illegal builtin, and also use that one
instead of the placeholder when compiling the wasm code initially.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2629853004
Cr-Commit-Position: refs/heads/master@{#42451}

As no one will ever try to allocate a Thread directly, we can just make
Thread a proxy of ThreadImpl by reinterpret_casting between both types.
This allows to not mention ThreadImpl in the header at all, and to
define it in an anonymous namespace in the implementation, allowing for
more optimizations.
It also saves runtime, as no memory load is needed to forward from
Thread to ThreadImpl, and we do not need to allocate ThreadImpl objects
on the heap.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2643443002
Cr-Commit-Position: refs/heads/master@{#42450}

When inlining allocations for Array and String iterators, make sure the
allocations have proper types on it (rather than just Type::Any). This
allows us to escape analyze the iterators in a couple of more cases,
i.e. in this very simple case:

  function f(a) {
    const it = a[Symbol.iterator]();
    return it.next().value;
  }

R=jarin@chromium.org
BUG=v8:4586,v8:5448

Review-Url: https://codereview.chromium.org/2640743003
Cr-Commit-Position: refs/heads/master@{#42449}

TBR=titzer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2639903003
Cr-Commit-Position: refs/heads/master@{#42448}

This also introduces exhaustive switch-cases for instance types.

BUG=chromium:681383

Review-Url: https://codereview.chromium.org/2646433002
Cr-Commit-Position: refs/heads/master@{#42447}

BUG=chromium:681241
NOTRY=true
TBR=bradnelson@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2644503002
Cr-Commit-Position: refs/heads/master@{#42446}

This fast path check compared a tagged smi and an untagged one, meaning that the slow path was always taken.

Review-Url: https://codereview.chromium.org/2641823002
Cr-Commit-Position: refs/heads/master@{#42445}

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2571563004
Cr-Commit-Position: refs/heads/master@{#42444}

Store breakpoint positions in the WasmSharedModuleData in order to set
them on new instantiations. Also redirect them to all live instances at
the time the breakpoint is set.

Inside the WasmDebugInfo, we store the BreakPointInfo objects to find
hit breakpoints.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2626253002
Cr-Commit-Position: refs/heads/master@{#42443}

We used dynamic dispatch before, which has considerable runtime
overhead. Pimpl (a.k.a. opaque pointer) has the same memory overhead
of one additional pointer, but less runtime overhead.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2639013002
Cr-Commit-Position: refs/heads/master@{#42442}

BUG=chromium:681088
NOTRY=true
TBR=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2637423002
Cr-Commit-Position: refs/heads/master@{#42441}

BUG=674089
R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2614563002
Cr-Commit-Position: refs/heads/master@{#42440}

BUG=

Review-Url: https://codereview.chromium.org/2635243002
Cr-Commit-Position: refs/heads/master@{#42439}

R=adamk@chromium.org
BUG=
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2634313002
Cr-Commit-Position: refs/heads/master@{#42438}

This is done out of courtesy for Node.js and will be
removed as soon as we branch for version 5.8.

R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2636423002
Cr-Commit-Position: refs/heads/master@{#42437}

Non-capturing groups so far did not have any effect, so we elided
them in the regexp parser. However, they do affect how lookarounds
are parsed: in unicode mode, lookarounds are not quantifiable. They
are however if wrapped in a group.

BUG=v8:5845

Review-Url: https://codereview.chromium.org/2636883002
Cr-Commit-Position: refs/heads/master@{#42436}

Collect Receiver feedback for abstract/strict equality in Ignition and
use it in TurboFan to optimize JSEqual and JSStrictEqual operations to
pointer equality instead of having to call Equal/StrictEqual builtins.

R=jarin@chromium.org
BUG=v8:5267,v8:5400

Review-Url: https://codereview.chromium.org/2639883002
Cr-Commit-Position: refs/heads/master@{#42435}

Use the representation selector to insert appropriate Smi checks for
CheckString and CheckInternalizedString when necessary.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2637363002
Cr-Commit-Position: refs/heads/master@{#42434}

BUG=681707
R=aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2641513003
Cr-Commit-Position: refs/heads/master@{#42433}

 - Currently WebAssembly.Memory.grow() assumes that it always has an instance associated with it,
 fix to grow and reflect new size when no instance is associated with memory object.
 - Correctness fixes for the js api, throw range errors instead of generic errors

BUG=chromium:680938

R=bradnelson@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2638243002
Cr-Commit-Position: refs/heads/master@{#42432}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f55127d..c94e6d2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/143ba4d..cfcae9b

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f7ce1a5..3a41cc3

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2636323003
Cr-Commit-Position: refs/heads/master@{#42431}

This rewrites the rest property into a runtime call which sets up the
correct properties in the newly created object.

- Changes flag to --harmony-object-rest-spread
- Changes pattern rewriter to desugar rest property
- Adds new runtime function CopyDataPropertiesWithExcludedProperties

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2620943002
Cr-Commit-Position: refs/heads/master@{#42430}

TBR=machenbach@chromium.org
NOPRESUBMIT=True
NOTRY=True
BUG=664915

Review-Url: https://codereview.chromium.org/2643563002
Cr-Commit-Position: refs/heads/master@{#42429}

BUG=644915
R=sergiyb@chromium.org,machenbach@chromium.org
NOTRY=True

Review-Url: https://codereview.chromium.org/2641523003
Cr-Commit-Position: refs/heads/master@{#42428}

BUG=chromium:680801
R=dgozman@chromium.org,pfeldman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2631553003
Cr-Commit-Position: refs/heads/master@{#42427}

R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2636173002
Cr-Commit-Position: refs/heads/master@{#42426}

The existing implementation assumes that return nodes have exactly one
real value input. This assumption does not hold for WebAssembly. To
avoid incorrect behavior, this CL turns of the reduction of returns
with a value input count != 1.

R=titzer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2638053002
Cr-Commit-Position: refs/heads/master@{#42425}

There were multiple bugs in the apply builtins on mips and mips64 which
caused them to always take the slow path by calling into the runtime to
create the array. The other bugs went undiscovered because those paths
were never taken.

Review-Url: https://codereview.chromium.org/2634393002
Cr-Commit-Position: refs/heads/master@{#42424}

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2637523002
Cr-Commit-Position: refs/heads/master@{#42423}

Port 743fdb25

Original Commit Message:

    This is just a bug. CompileLazy knows how to look in the
    SharedFunctionInfo for code (or bytecode, essentially) if it
    finds nothing in the OptimizedCodeMap. Ensure that behavior.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=681543
LOG=N

Review-Url: https://codereview.chromium.org/2641473002
Cr-Commit-Position: refs/heads/master@{#42422}

Port b83c3d29

Original Commit Message:

    When a function is declared in global scope, the closure is created
    by the DeclareGlobals runtime service. It needs a pointer to the
    literals array, already allocated in the feedback vector. This
    fixes a bug where it's behavior wasn't in sync with CreateClosure,
    which accepts the literals from the vector.

    This enables a follow-on performance improvement in the CompileLazy
    builtin.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=680637
LOG=N

Review-Url: https://codereview.chromium.org/2634423002
Cr-Commit-Position: refs/heads/master@{#42421}

Uses the structure of an IEEE float to speed up
DoubleToUint32IfEqualToSelf, similar to FastD2UI. Micro-benchmarks show
a ~1.2x-2x speed-up, depending on the input.

Review-Url: https://codereview.chromium.org/2636453003
Cr-Commit-Position: refs/heads/master@{#42420}