The Crankshaft fast case for String.fromCharCode() unconditionally
deoptimizes on all non-int32 inputs, even tho it would be perfectly
valid to just truncate the index to an int32.

R=ishell@chromium.org
BUG=chromium:587068
LOG=n

Review URL: https://codereview.chromium.org/1727873003

Cr-Commit-Position: refs/heads/master@{#34243}

The InstructionSelector::CanCover() heuristic was not correctly set to
match loads that are wired into the effect chain (i.e. when the input
comes from the JavaScript pipeline instead of the RawMachineAssembler).
Also the InstructionSelector on x64 was confused by the
CanBeBetterLeftOperand heuristic, which prevented proper covering for
map checks generated by the JavaScript pipeline.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1734503002

Cr-Commit-Position: refs/heads/master@{#34242}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1723613002

Cr-Commit-Position: refs/heads/master@{#34241}

Failed after:
https://codereview.chromium.org/1706343002

TBR=ofrobots@google.com, mattloring@google.com, rmcilroy@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1727363002

Cr-Commit-Position: refs/heads/master@{#34240}

These macro operators represent a conditional eager deoptimization exit
without explicit branching, which greatly reduces overhead of both
scheduling and register allocation, and thereby greatly reduces overall
compilation time, esp. when there are a lot of eager deoptimization
exits.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1721103003

Cr-Commit-Position: refs/heads/master@{#34239}

Revert of Replace slots buffer with remembered set. (patchset #14 id:250001 of https://codereview.chromium.org/1703823002/ )

Reason for revert:
Revert because of canary crashes: crbug.com/589413

Original issue's description:
> Replace slots buffer with remembered set.
>
> Slots pointing to evacuation candidates are now recorded in the new RememberedSet<OLD_TO_OLD>.
>
> The remembered set is extended to support typed slots.
>
> During parallel evacuation all migration slots are recorded in local slots buffers.
> After evacuation all local slots are added to the remembered set.
>
> BUG=chromium:578883
> LOG=NO
>
> Committed: https://crrev.com/2285a99ef6f7d52f4f0c4d88a7db4224443ee152
> Cr-Commit-Position: refs/heads/master@{#34212}

TBR=jochen@chromium.org,hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:578883

Review URL: https://codereview.chromium.org/1725073003

Cr-Commit-Position: refs/heads/master@{#34238}

Since both null and undefined are also marked as undetectable now, we
can just test that bit instead of having the CompareNilIC try to collect
feedback to speed up the general case (without the undetectable bit
being used).

Drive-by-fix: Update the type system to match the new handling of
undetectable in the runtime.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1722193002

Cr-Commit-Position: refs/heads/master@{#34237}

This is the first step in process of replacing JR and JALR instructions
with JIC and JIALC for r6. Trampoline in r6 now uses JIC. Also
BranchLong and BranchAndLinkLong MacroAssembler functions now use JIC
and JIALC in r6 if branch delay slot is not used.

BUG=

Review URL: https://codereview.chromium.org/1573983002

Cr-Commit-Position: refs/heads/master@{#34236}

Now that JALR to JAL optimization is removed, the value of the constant
kInstructionsFor32BitConstant and comments are adjusted accordingly.

BUG=

Review URL: https://codereview.chromium.org/1690133004

Cr-Commit-Position: refs/heads/master@{#34235}

Implements poisson unsampling. A poisson process is used to determine
which samples to collect based on a sample rate. Unsampling will
approximate the true number of allocations at each site taking into
account that smaller allocations are less likley to be sampled.

This work was originally being done in the agent that
consumes profiles but it is more efficient to do it here
and individual consumers of the API should not have to
worry about the mathematical details of the sampling
process.

R=ofrobots@google.com
BUG=

Review URL: https://codereview.chromium.org/1706343002

Cr-Commit-Position: refs/heads/master@{#34234}

We previously supported use of bitwise operations to convert
from intish to int, but use of kAsmInt in some places and kAsmIntQ
in others prevents this from working with heap accesses.
Switch to use kAsmIntQ where appropriate (even though intish_ != 0
in principle captures the superset of these cases),
as it's more conservative (and uses types.h better).

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1731603002

Cr-Commit-Position: refs/heads/master@{#34233}

Cr-Commit-Position: refs/heads/master@{#34232}

  port 38915ed7 (r34211)

  original commit message:
  This implements a mechanism to track the exact depth of the operand
  stack in full-codegen for every sub-expression visitation. So far we
  only tracked the depth at statement level, but not at expression level.
  With the introduction of do-expressions it will be possible to construct
  local control flow (i.e. break, continue and friends) that target labels
  at an arbitrary operand stack depth, making this tracking a prerequisite
  for full do-expression support.

BUG=

Review URL: https://codereview.chromium.org/1728953003

Cr-Commit-Position: refs/heads/master@{#34231}

The Intl object used to keep around functions which are bound to the
receiver and memoized in the object (as required by the ECMA-402 spec)
in ordinary properties with names like __boundformat__. This patch
instead stores those methods in private symbol properties, so they are
not exposed to users. A search in GitHub didn't find any uses of
__boundformat__ (whereas the same search found plenty of usages of
other V8 Intl features), so I think this should be fine in terms of
web compatibility.

BUG=v8:3785
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1728823002

Cr-Commit-Position: refs/heads/master@{#34230}

A recent ES2016 draft spec clarification indicates that, if -0 is
passed into Array.prototype.indexOf or Array.prototype.lastIndexOf
as the starting index, and the result is found at index 0, then +0
rather than -0 should be returned. This patch ensures that V8 has
that result, which is consistent with what some other browsers
return. The patch allows a couple test262 tests to pass.

R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1729653002

Cr-Commit-Position: refs/heads/master@{#34229}

This allows expressions like:
(x + y) & -1
[intish] & [signed]

The previous conversion condition was too strict (intended to
forbid non-int expression conversion). Expressing in
a different way.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1717213002

Cr-Commit-Position: refs/heads/master@{#34228}

Port 38915ed7

Original commit message:
    This implements a mechanism to track the exact depth of the operand
    stack in full-codegen for every sub-expression visitation. So far we
    only tracked the depth at statement level, but not at expression level.
    With the introduction of do-expressions it will be possible to construct
    local control flow (i.e. break, continue and friends) that target labels
    at an arbitrary operand stack depth, making this tracking a prerequisite
    for full do-expression support.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4755,v8:4488
LOG=n

Review URL: https://codereview.chromium.org/1729613002

Cr-Commit-Position: refs/heads/master@{#34227}

This patch moves the ES2015 Symbol.species feature from staging to
shipping. @@species should be good to ship now that the regression
from fast-path cases in concat, slice and splice have been addressed.

R=adamk
BUG=v8:4093
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1721993002

Cr-Commit-Position: refs/heads/master@{#34226}

For now WasmFrame doesn't summarize the wasm frames. That'll require adding the
metadata in wasm-compiler similar to DeoptimizationInputData.

Teach the basic backtrace to iterate over stack frames instead of JS frames.

Update the wasm stack test.

`git cl format` touches random lines in files I touch.

R=titzer@chromium.org
TEST=d8 --test --expose-wasm test/mjsunit/mjsunit.js test/mjsunit/wasm/stack.js

Originally landed in: https://codereview.chromium.org/1712003003/
Reverted in: https://codereview.chromium.org/1730673002/

This patch puts the JSFunction on the C++ stack.

Review URL: https://codereview.chromium.org/1724063002

Cr-Commit-Position: refs/heads/master@{#34225}

The first operand to the CallRuntime class of bytecodes is the
ID of the runtime function being called. Before this commit
the ID was printed as plain uint16_t, now we get something like:

  B(CallRuntime) U16(Runtime::Add) ...

This change is intended to make both the golden files more
resistant to modifications of the i::Runtime::FunctionId enum
and the output of generate-bytecode-expectations more readable.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1723223002

Cr-Commit-Position: refs/heads/master@{#34224}

Now that register validation is working again, re-enable
for asm->wasm embenchen tests.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1724043002

Cr-Commit-Position: refs/heads/master@{#34223}

asm.js permits both:
int * constant
constant * int

It does not, however, allow intishes in multiplies.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm,test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1718083004

Cr-Commit-Position: refs/heads/master@{#34222}

Revert of Add WasmFrame, backtraces reflect wasm's presence (patchset #9 id:160001 of https://codereview.chromium.org/1712003003/ )

Reason for revert:
[Sheriff] Seems to break gcmole:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/8295

Original issue's description:
> Add WasmFrame, backtraces reflect wasm's presence
>
> For now WasmFrame doesn't summarize the wasm frames. That'll require adding the
> metadata in wasm-compiler similar to DeoptimizationInputData.
>
> Teach the basic backtrace to iterate over stack frames instead of JS frames.
>
> Update the wasm stack test.
>
> `git cl format` touches random lines in files I touch.
>
> R=titzer@chromium.org
> TEST=d8 --test --expose-wasm test/mjsunit/mjsunit.js test/mjsunit/wasm/stack.js
>
> Committed: https://crrev.com/aeca945786dcccad3efecfddbf2c07aefa524a56
> Cr-Commit-Position: refs/heads/master@{#34220}

TBR=titzer@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,jfb@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1730673002

Cr-Commit-Position: refs/heads/master@{#34221}

For now WasmFrame doesn't summarize the wasm frames. That'll require adding the
metadata in wasm-compiler similar to DeoptimizationInputData.

Teach the basic backtrace to iterate over stack frames instead of JS frames.

Update the wasm stack test.

`git cl format` touches random lines in files I touch.

R=titzer@chromium.org
TEST=d8 --test --expose-wasm test/mjsunit/mjsunit.js test/mjsunit/wasm/stack.js

Review URL: https://codereview.chromium.org/1712003003

Cr-Commit-Position: refs/heads/master@{#34220}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1716243002

Cr-Commit-Position: refs/heads/master@{#34219}

Lost in the repo shuffle:
https://github.com/WebAssembly/v8-native-prototype/pull/102

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1702293002

Cr-Commit-Position: refs/heads/master@{#34218}

Adding a version of embenchen, modified to pass through
the asm->wasm javascript interface.
Disabling for now as fixes required to run it are outstanding.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/embenchen
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1716273002

Cr-Commit-Position: refs/heads/master@{#34217}

This filters test and third_party files to get a speed-up
when running tests and when collecting profile data.

BUG=chromium:568949
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1730543002

Cr-Commit-Position: refs/heads/master@{#34216}

SuperPropertyArgumnets is less useful after deprecating strong mode.

BUG=v8:4280,v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1721723002

Cr-Commit-Position: refs/heads/master@{#34215}

TBR=rmcilroy@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1727453003

Cr-Commit-Position: refs/heads/master@{#34214}

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1714793003

Cr-Commit-Position: refs/heads/master@{#34213}

Slots pointing to evacuation candidates are now recorded in the new RememberedSet<OLD_TO_OLD>.

The remembered set is extended to support typed slots.

During parallel evacuation all migration slots are recorded in local slots buffers.
After evacuation all local slots are added to the remembered set.

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1703823002

Cr-Commit-Position: refs/heads/master@{#34212}

This implements a mechanism to track the exact depth of the operand
stack in full-codegen for every sub-expression visitation. So far we
only tracked the depth at statement level, but not at expression level.
With the introduction of do-expressions it will be possible to construct
local control flow (i.e. break, continue and friends) that target labels
at an arbitrary operand stack depth, making this tracking a prerequisite
for full do-expression support.

R=rossberg@chromium.org,jarin@chromium.org
BUG=v8:4755,v8:4488
LOG=n

Review URL: https://codereview.chromium.org/1706283002

Cr-Commit-Position: refs/heads/master@{#34211}

R=mcilroy@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1723803004

Cr-Commit-Position: refs/heads/master@{#34210}

Until now inlining in TurboFan was staged behind --turbo, which means
that it wasn't enabled with --turbo-shipping. It seems reasonable to
ship it now, since Clusterfuzz had fun with it for a year already, and
we need to reach parity with Crankshaft with more and more things being
enabled behind --turbo-shipping.

Review URL: https://codereview.chromium.org/1721243002

Cr-Commit-Position: refs/heads/master@{#34209}

So far counters did not work when they were reentrant and thus would lead to
wrong bookkeeping of the counter stack. Using a separate stack-allocated linked
list to track the timer stack solves this issue. This is a temporary workaround
with the limitations of the counter system in mind. Eventually we will move to
the trace-based system for these kind of statistics.

BUG=v8:4770
LOG=n

Review URL: https://codereview.chromium.org/1695733002

Cr-Commit-Position: refs/heads/master@{#34208}

This fixes an issue encountered in wasm payloads, where we do not
(yet) optimize away duplicate phi definitions - phis in the same block
with the same operand list; and when move optimizations merge phi-
defining moves into the block defining the phi. If all this happens, the
register allocation validator back-propagation fails because it can't
distinguish the duplicate phis, when traversing backwards.

BUG=

Review URL: https://codereview.chromium.org/1720003002

Cr-Commit-Position: refs/heads/master@{#34207}

When assigning to an integer view of the heap an intish
value does not need to be collapsed with |0.
Similarly a floatish value does not need to be collapsed with
fround when assigned to a float view of the heap.
i32[0] = i32_1 + i32_2;  // ok
f32[0] = f32_1 + f32_2;  // ok

However, floatish values cannot be safely assigned to double
arrays.
f64[0] = f32_1 + f32_2;  // not ok

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm,test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1722473002

Cr-Commit-Position: refs/heads/master@{#34206}

  port e032a98d (r34190)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1717333003

Cr-Commit-Position: refs/heads/master@{#34205}

  port 0e43ff56 (r34187)

  original commit message:
  The InstructionSelector now associates an effect level to every node in a block.

  The effect level of a node is the number of non-eliminatable nodes encountered from the beginning of the block to the node itself.

  With this change, on ia32 and x64, a load from memory into a register can be replaced by a memory operand if all of the following conditions hold:

  1. The only use of the load is in a 32 or 64 bit word comparison.
  2. The user node and the load node belong to the same block.
  3. The values of the operands have the same size (i.e., no need to zero-extend or sign-extend the result of the load).

BUG=

Review URL: https://codereview.chromium.org/1724473004

Cr-Commit-Position: refs/heads/master@{#34204}