These operators are really pure on the JavaScript level, and were only
part of the effect chain to make sure we don't accidentially schedule
them right after raw allocations, which is no longer an issue since we
now have the concept of atomic regions.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1893543004

Cr-Commit-Position: refs/heads/master@{#35552}

Revert of [turbofan] Improve lowering of ObjectIs<Type> somewhat. (patchset #1 id:1 of https://codereview.chromium.org/1872143002/ )

Reason for revert:
Looking at types in ChangeLowering is generally unsafe.

Original issue's description:
> [turbofan] Improve lowering of ObjectIs<Type> somewhat.
>
> If we already know that the input to one of the ObjectIs<Type> nodes is
> TaggedPointer, we don't need to perform the Smi check at runtime.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/4fc4978cee0bb7ad2ae8681a67b7032eba6a7d11
> Cr-Commit-Position: refs/heads/master@{#35368}

TBR=jarin@chromium.org,bmeurer@google.com
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1893123002

Cr-Commit-Position: refs/heads/master@{#35551}

R=jarin@chromium.org

Committed: https://crrev.com/20eff45de11609934be339dffe46276ff0a4bc22
Cr-Commit-Position: refs/heads/master@{#35509}

Review URL: https://codereview.chromium.org/1887343002

Cr-Commit-Position: refs/heads/master@{#35550}

Revert of [turbofan] Remove the leftover LoadBuffer hacks. (patchset #1 id:1 of https://codereview.chromium.org/1887343002/ )

Reason for revert:
Using types in ChangeLowering is generally unsafe.

Original issue's description:
> [turbofan] Remove the leftover LoadBuffer hacks.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/20eff45de11609934be339dffe46276ff0a4bc22
> Cr-Commit-Position: refs/heads/master@{#35509}

TBR=jarin@chromium.org,mstarzinger@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1893893002

Cr-Commit-Position: refs/heads/master@{#35549}

Revert of [Atomics] Remove Atomics code stubs; use TF ops (patchset #6 id:100001 of https://codereview.chromium.org/1891033002/ )

Reason for revert:
[Sheriff] Breaks
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20ASAN%20mipsel%20-%20debug%20builder/builds/6121

Original issue's description:
> [Atomics] Remove Atomics code stubs; use TF ops
>
> This is a much cleaner solution, which won't require nearly as much
> architecture-specific code. Thanks bmeurer@!
>
> BUG=v8:4614
> LOG=y
> R=bmeurer@chromium.org,jarin@chromium.org
>
> Committed: https://crrev.com/6ff5881b1def45b35384572f61327e42563a89c3
> Cr-Commit-Position: refs/heads/master@{#35547}

TBR=bmeurer@chromium.org,jarin@chromium.org,rodolph.perfetta@gmail.com,binji@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review URL: https://codereview.chromium.org/1895643002

Cr-Commit-Position: refs/heads/master@{#35548}

This is a much cleaner solution, which won't require nearly as much
architecture-specific code. Thanks bmeurer@!

BUG=v8:4614
LOG=y
R=bmeurer@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1891033002

Cr-Commit-Position: refs/heads/master@{#35547}

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1893713002

Cr-Commit-Position: refs/heads/master@{#35546}

Revert of Get rid of UnsafeCurrent in Sampler (patchset #12 id:220001 of https://codereview.chromium.org/1858143003/ )

Reason for revert:
[Sheriff] Breaks tsan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/8999

Original issue's description:
> Get rid of UnsafeCurrent in Sampler
>
> Currently we are using UnsafeCurrent in async signal handler to acquire the
> isolate of VM thread, but we want to get rid of that since it prevents V8 from
> being thread agnostic.
>
> This patch replaces UnsafeCurrent with a static map, where we store a map of
> samplers for threads, and makes it accessible by signal handler.
>
> BUG=v8:4889
> LOG=n
>
> Committed: https://crrev.com/62fb4775fea0d56d8a175baf1d902213f6752168
> Cr-Commit-Position: refs/heads/master@{#35541}

TBR=jochen@chromium.org,alph@chromium.org,fmeawad@chromium.org,yangguo@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4889

Review URL: https://codereview.chromium.org/1897673002

Cr-Commit-Position: refs/heads/master@{#35545}

Revert of Migrate FastCloneShallowObjectStub to TurboFan (patchset #9 id:180001 of https://codereview.chromium.org/1838283003/ )

Reason for revert:
The boilerplate is copied based on the boilerplate + memento size, which reads off the end of the boilerplate.

Original issue's description:
> Migrate FastCloneShallowObjectStub to TurboFan
>
> BUG=
>
> Committed: https://crrev.com/4c2b04542f263b2679194f9fb75672ebbe72b924
> Cr-Commit-Position: refs/heads/master@{#35330}
>
> Committed: https://crrev.com/7fdfdc12d4e4291348112ace4278a827f57f2eb9
> Cr-Commit-Position: refs/heads/master@{#35494}

TBR=bmeurer@chromium.org,jkummerow@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1888043006

Cr-Commit-Position: refs/heads/master@{#35544}

BUG=602659
LOG=N

Review URL: https://codereview.chromium.org/1891203002

Cr-Commit-Position: refs/heads/master@{#35543}

This patch correctly re-scopes inner scopes that can appear in do
expressions used as initializers to arrow parameters.

R=rossberg@chromium.org
BUG=v8:4904
LOG=N

Review URL: https://codereview.chromium.org/1887743002

Cr-Commit-Position: refs/heads/master@{#35542}

Currently we are using UnsafeCurrent in async signal handler to acquire the
isolate of VM thread, but we want to get rid of that since it prevents V8 from
being thread agnostic.

This patch replaces UnsafeCurrent with a static map, where we store a map of
samplers for threads, and makes it accessible by signal handler.

BUG=v8:4889
LOG=n

Review URL: https://codereview.chromium.org/1858143003

Cr-Commit-Position: refs/heads/master@{#35541}

BUG=

Review URL: https://codereview.chromium.org/1887343004

Cr-Commit-Position: refs/heads/master@{#35540}

Runtime_OptimizeFunctionOnNextCall and Runtime_DeoptimizeFunction asserts that
the argument is a JSFunction object.These are used by fuzzers to get coverage
of optimizations in compiler. Having an assert causes a fuzzer test to fail
when OptimizeFunctionOnNextCall is called on objects that are not functions.
We can instead, silently return on such calls.

BUG=chromium:601391
LOG=N

Review URL: https://codereview.chromium.org/1883603002

Cr-Commit-Position: refs/heads/master@{#35539}

BUG=v8:4909
R=hpayer@chromium.org,ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1890123002

Cr-Commit-Position: refs/heads/master@{#35538}

Port 5e9ddf6c

Original commit message:
    * New atomic code stubs for x64, ia32, arm, arm64
    * Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
      to macro-assembler-ia32 (API based on x64 macro assembler)
    * Remove runtime implementation of Atomics.load, the code stub should always be
      called instead
    * Add new test to mjsunit atomics test; check that Smi values of different
      sizes are supported when possible, else fall back to HeapNumbers

    These changes were needed to add another codestub:
    * Bump kStubMajorKeyBits from 7 to 8
    * Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12

R=binji@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=v8:4614
LOG=N

Review URL: https://codereview.chromium.org/1882733008

Cr-Commit-Position: refs/heads/master@{#35537}

Revert of Immediately cache compiled scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1890083002/ )

Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/8769

Auto-bisect points to this CL.

Original issue's description:
> Immediately cache compiled scripts.
>
> Usually, script compilation is expensive enough to warrant the extra
> overhead of caching scripts immediatly.
>
> BUG=chromium:588900
> R=yangguo@chromium.org
> LOG=n
>
> Committed: https://crrev.com/3533c084d470912384988768c4b3b109304da357
> Cr-Commit-Position: refs/heads/master@{#35527}

TBR=yangguo@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:588900

Review URL: https://codereview.chromium.org/1882833006

Cr-Commit-Position: refs/heads/master@{#35536}

Unports parts of https://codereview.chromium.org/1828543003
as per suggestion in
https://codereview.chromium.org/1886293002/

Ports https://codereview.chromium.org/1532723003

Also restores -fmsc-version=1800 to support win-clang with
MSVS 2013.

BUG=chromium:603011
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1895453002

Cr-Commit-Position: refs/heads/master@{#35535}

Port 9336f4cc

Original commit message:
    This is useful for escape analysis, and helps upcoming changes to
    type feedback gathering.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1887003004

Cr-Commit-Position: refs/heads/master@{#35534}

Port 0c05e02f

Original commit message:
    Modifies Ignition to store code entry addresses in the dispatch table
    rather than code objects. This allows the interpreter to avoid
    calculating the code entry address from the code object on every
    dispatch and provides a ~5-7% performance improvement on Octane with
    Ignition.

    This change adds ArchOpcode::kArchTailCallAddress to TurboFan to enable
    tail call dispatch using these code addresses. It also adds a Dispatch
    linkage creator (distinct from the stub linkage type used previously) to
    allow targetting a code address target (which will diverge further from
    the stub linkage type when we remove the context machine register in
    Ignition).

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1887263003

Cr-Commit-Position: refs/heads/master@{#35533}

This hoists all bailouts out of OptimizedCompileJob::CreateGraph into
the compiler pipeline. The reason is that this moves them to a point
where we can still influence the decision which compiler to pick and
hence gives us more freedom with modeling various pipelines.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1883313003

Cr-Commit-Position: refs/heads/master@{#35532}

BUG=

Review URL: https://codereview.chromium.org/1887343003

Cr-Commit-Position: refs/heads/master@{#35531}

Quit using the global array in uri code.

R=yangguo@chromium.org
BUG=chromium:602970
LOG=N

Review URL: https://codereview.chromium.org/1889133003

Cr-Commit-Position: refs/heads/master@{#35530}

Replace page link walking with arithmetic computation.

BUG=chromium:603460
LOG=N

Review URL: https://codereview.chromium.org/1883933003

Cr-Commit-Position: refs/heads/master@{#35529}

Seems like node.js depends on it in many places. At least try to get rid
of WeakCallbackData vs WeakCallbackInfo

BUG=
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1883173002

Cr-Commit-Position: refs/heads/master@{#35528}

Usually, script compilation is expensive enough to warrant the extra
overhead of caching scripts immediatly.

BUG=chromium:588900
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1890083002

Cr-Commit-Position: refs/heads/master@{#35527}

The default NaN mode was originally used to identify holes in double
arrays. With (https://codereview.chromium.org/863633002/) signalling
NaNs are used for that, and the default NaN mode is not needed anymore.
Without the default NaN mode it is easier to satisfy the WebAssembly
spec which requires that quiet NaNs are preserved.

R=titzer@chromium.org, rodolph.perfetta@arm.com, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1884193003

Cr-Commit-Position: refs/heads/master@{#35526}

This adds an ObjectIsString operator and hooks it up with
JSNativeContextSpecialization (to remove the use of some machine
operators there).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1894523002

Cr-Commit-Position: refs/heads/master@{#35525}

Rolling v8/tools/clang to d9ee849b2aa65cef903af3044e03205d92343093

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1883413002

Cr-Commit-Position: refs/heads/master@{#35524}

PersistentValueMap is used to hold per-world wrappers in the blink. Currently,
when we trace wrappers, we visit wrappers in all worlds via this PersistentValueMap. This cl introduces convenient (and faster) way of registering these external references.

BUG=468240
LOG=no

Review URL: https://codereview.chromium.org/1883043003

Cr-Commit-Position: refs/heads/master@{#35523}

  port 6df9a22c (r35187)

  original commit message:
  The HandlerCompiler did not properly handle the weird edge case when a
  sloppy mode function was installed as an accessor on one of the value
  wrapper prototypes and then accessed via a load from a primitive value.
  In this case we just passed the primitive value untouched instead of
  properly wrapping it first. The CallFunction builtin properly deals with
  all the funny edge cases, so we use it instead of duplicating almost all
  of the logic here (the performance difference is neglible).

BUG=

Review URL: https://codereview.chromium.org/1884293003

Cr-Commit-Position: refs/heads/master@{#35522}

This prefixes the escape analysis flag with "experimental", thereby
making sure the flag in question is not being fuzzed. It will reduce
noise levels on ClusterFuzz again.

R=jarin@chromium.org
BUG=chromium:603653
LOG=n

Review URL: https://codereview.chromium.org/1894513002

Cr-Commit-Position: refs/heads/master@{#35521}

BUG=v8:4846
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1889903003

Cr-Commit-Position: refs/heads/master@{#35520}

Revert of Rehash and clear deleted entries in weak collections during GC (patchset #8 id:140001 of https://codereview.chromium.org/1877233005/ )

Reason for revert:
[Sheriff] Speculative revert. Suspect for gc stress crashes, like:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/5119

Original issue's description:
> Rehash and clear deleted entries in weak collections during GC
>
> Otherwise, they'll just keep growing until we run out of memory or hit the FixedArray's maximum capacity.
>
> BUG=v8:4909
> R=hpayer@chromium.org
> LOG=n
>
> Committed: https://crrev.com/e093a047796d4c0575fe63d36529e7fe89b8865d
> Cr-Commit-Position: refs/heads/master@{#35514}

TBR=hpayer@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4909

Review URL: https://codereview.chromium.org/1891863003

Cr-Commit-Position: refs/heads/master@{#35519}

The default NaN mode was originally used to identify holes in double
arrays. With (https://codereview.chromium.org/863633002/) signalling
NaNs are used for that, and the default NaN mode is not needed anymore.
Without the default NaN mode it is easier to satisfy the WebAssembly
spec which requires that quiet NaNs are preserved.

R=titzer@chromium.org, rodolph.perfetta@arm.com, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1884193002

Cr-Commit-Position: refs/heads/master@{#35518}

This moves the responsibility of preparing full-codegen code with
deoptimization support into the backends. This avoids generating such
code when optimization can be done directly from existing bytecode.

R=bmeurer@chromium.org
BUG=v8:4280
LOG=n

Review URL: https://codereview.chromium.org/1883403002

Cr-Commit-Position: refs/heads/master@{#35517}

BUG=

Committed: https://crrev.com/5210f167e802a3758aac1f2900a6560c8de07831
Cr-Commit-Position: refs/heads/master@{#35231}

Review URL: https://codereview.chromium.org/1834373003

Cr-Commit-Position: refs/heads/master@{#35516}

This has been fixed by 165186f2.

R=machenbach@chromium.org
BUG=v8:4893,v8:4894
LOG=N

Review URL: https://codereview.chromium.org/1882923006

Cr-Commit-Position: refs/heads/master@{#35515}

Otherwise, they'll just keep growing until we run out of memory or hit the FixedArray's maximum capacity.

BUG=v8:4909
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1877233005

Cr-Commit-Position: refs/heads/master@{#35514}

We have trouble with Math.fround(MEM[...]).  Since we now properly type
LoadBuffer (it can produce undefined), lowering of fround has stopped
triggering (as it requires Number type).  This CL is a quick fix for this issue
- we simply trigger the lowering for NumberOrUndefined and let representation
selection/truncation analysis deal with this.

Ultimately, we would want to insert some 'simplified' ToNumber conversion
that would be optimized as much as possible during representation
selection.

BUG=chromium:603802
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1893483003

Cr-Commit-Position: refs/heads/master@{#35513}