Previously, CodeAssembler Variables declared in an explicit C++ scope would
continue to be merged into future labels beyond that scope, causing
asserts. This CL ensures that Variables are properly ignored when they go out of
scope.

Review-Url: https://codereview.chromium.org/2035683002
Cr-Commit-Position: refs/heads/master@{#36690}

Previously, turbofan selected the gap use from first predecessor block when
hinting a phi, unless that block was deferred, in which case the gap move from
the first non-deferred predecessor block was chosen.

This strategy didn't guarantee that an important invariant was maintained: the
predecessor blocks chosen for hinting phis must preceed the phi's block in the
rpo ordering. In most cases the strategy worked, since graphs generated by the
AstGraphBuilder and existing stubs just happened to always generate schedules
where this rpo ordering property for the first predecessor block, but it is
quite possible to generate a code stub by hand that doesn't have this property
(see included test case).

After this CL, the allocator chooses either the the first non-deferred
"rpo-preceeding" block to be the hinting block, or the first deferred
"rpo-preceeding" block if that doesn't exist. In all previously-existing code,
this behavior is the same as the original algorithm, but has the benefit of not
failing in the register allocator in hand-crafted stubs where all the
"rpo-preceeding" predecessors are all in deferred code.

Review-Url: https://codereview.chromium.org/2030463003
Cr-Commit-Position: refs/heads/master@{#36689}

The PromiseSet operation is called with two types of promises
1) A newly created promise object with no properties
2) Promise object with callbacks and other properties

PromiseSet is called with the first type of promise (with no
properties) from multiple call sites. PromiseSet is called with the
second type of promise object only from FulfillPromise. Furthermore,
this call only sets the value and status of the promise, the rest of
the values are reset to UNDEFINED (which isn't necessary).

This patch inlines the calls to set the value and status of the
promise in FulfillPromise, instead of calling out to PromiseSet.

This patch also reduces the number of symbol lookups, as we only set
the value and status of the promise, and don't change the callback or
deferred symbols.

This patch results in a performance improvement of 2.8% over 5 runs in
the bluebird benchmark.

BUG=v8:5046

Review-Url: https://codereview.chromium.org/2025073002
Cr-Commit-Position: refs/heads/master@{#36688}

Port a2fef3af

Original commit message:

    This CL introduces a DECLARE_DEFAULT_DESCRIPTOR macro that helps defining a
    CallInterfaceDescriptor in a cases where it is not important which registers
    to use for passing arguments. One can use such descriptors for new TurboFan stubs.

    HasPropertyDescriptor now uses the new machinery.

R=ishell@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2034773002
Cr-Commit-Position: refs/heads/master@{#36687}

[stubs] Extend HasProperty stub with dictionary-mode, string wrapper and double-elements objects support.

This CL also replaces some Branch() usages with GotoIf/GotoUnless.

(This is a reland after fixing issues that prevented this CL from landing in other CLs).

BUG=v8:2743
LOG=Y

Committed: https://crrev.com/24066b6df4259b302edfa1db884c479008776a7e
Cr-Commit-Position: refs/heads/master@{#36657}

Review-Url: https://codereview.chromium.org/1995453002
Cr-Commit-Position: refs/heads/master@{#36686}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2033103002
Cr-Commit-Position: refs/heads/master@{#36685}

... to ensure that the zone is properly shut down.

Review-Url: https://codereview.chromium.org/2034463003
Cr-Commit-Position: refs/heads/master@{#36684}

... since CodeStubAssembler does not belong to v8::internal::compiler namespace anymore.

Review-Url: https://codereview.chromium.org/2035533003
Cr-Commit-Position: refs/heads/master@{#36683}

    Some system header files on AIX include inttypes.h without
    defining __STDC_FORMAT_MACROS and therefore the printf format
    specifier macro (for eg. PRId64) doesn't get defined as they
    are guarded with __STDC_FORMAT_MACROS macro on AIX.
    This error showed up recently when the format specifier was used in
    wasm-interpreter.cc, where a AIX system header file is included
    which also includes inttypes.h without defining __STDC_FORMAT_MACROS.

R=ahaas@chromium.org, titzer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2033483002
Cr-Commit-Position: refs/heads/master@{#36682}

Most maps have a small code cache (often only one entry), so this patch
optimizes memory consumption of such cases by using plain FixedArrays,
only switching to CodeCacheHashTables when the number of cached entries
gets so large that linear-scan lookups get too slow.

On loading inbox.google.com, this gets the aggregate size of all maps'
code caches (there are about 13,600 of them) from 4300 KB to 970 KB.

Review-Url: https://codereview.chromium.org/2021373002
Cr-Commit-Position: refs/heads/master@{#36681}

It should work just the same as Compile() and CompileOptimized().

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2033053002
Cr-Commit-Position: refs/heads/master@{#36680}

This removes the frame state input representing the before-state from
nodes having the {JSCallRuntime} operator. These frame states can by now
be found via checkpoints in the graph. It also makes the predicate for
runtime function ids (i.e. {Linkage::NeedsFrameStateInput}) binary.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2018353004
Cr-Commit-Position: refs/heads/master@{#36679}

Object statistics were collected during the mark compact phase. If
an incremental marking happened before mark compact phase then most
of the objects are already visited and hence this phase does not collect
accurate statistics. This cl updates incremental marking pass to collect
object statistics along with mark compact phase.

BUG=

Review-Url: https://codereview.chromium.org/1943423002
Cr-Commit-Position: refs/heads/master@{#36678}

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2032733003
Cr-Commit-Position: refs/heads/master@{#36677}

In one corner case, we incorrectly returned a value without first wrapping it in
an iterator result object.

R=littledan@chromium.org
BUG=v8:5057

Review-Url: https://codereview.chromium.org/2034653002
Cr-Commit-Position: refs/heads/master@{#36676}

This CL introduces a DECLARE_DEFAULT_DESCRIPTOR macro that helps defining a CallInterfaceDescriptor in a cases where it is not important which registers to use for passing arguments. One can use such descriptors for new TurboFan stubs.

HasPropertyDescriptor now uses the new machinery.

Review-Url: https://codereview.chromium.org/2002143002
Cr-Commit-Position: refs/heads/master@{#36675}

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to
     definitions until checkpoint is reached. It also records type-check decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types (and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes and/or checks.

3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one place and
  with clearer input/output protocol for each sub-phase. I would prefer to do this once
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would affect
  the kind of truncations that they can handle. E.g., if we know that a node produces
  a number, we can omit the oddball check in the CheckedTaggedToFloat64 lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n

Review-Url: https://codereview.chromium.org/1921563002
Cr-Commit-Position: refs/heads/master@{#36674}

BUG=none
R=machenbach@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2034643002
Cr-Commit-Position: refs/heads/master@{#36673}

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2038463003 .

Cr-Commit-Position: refs/heads/master@{#36672}

It's not safe to look at the types after SimplifiedLowering runs,
as the types are unreliable by that time. So better make sure we
nuke the types first.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2032613006
Cr-Commit-Position: refs/heads/master@{#36671}

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2032713003
Cr-Commit-Position: refs/heads/master@{#36670}

This removes the frame state input representing the before-state from
nodes having the {JSCallFunction} or {JSCallConstruct} operator. These
frame states can by now be found via checkpoints in the graph.

R=bmeurer@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2025573003
Cr-Commit-Position: refs/heads/master@{#36669}

We use StringFromCharCode to optimize calls to String.fromCharCode with
a single Number argument for now. We will use it to also implement the
charAt method on the String prototype.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2037453003
Cr-Commit-Position: refs/heads/master@{#36668}

Rolling v8/build to 2a6b3280927ceaff306473034f1f6c1b390c938b

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2029403002
Cr-Commit-Position: refs/heads/master@{#36667}

This sets the default for the feature, as chromium expects
it: It is turned on for all platforms except ios.

Chromium's build_override can be removed after this.

This will also allow to override the value as a gn arg.

BUG=chromium:474921,chromium:616034
NOTRY=true

Review-Url: https://codereview.chromium.org/2025803003
Cr-Commit-Position: refs/heads/master@{#36666}

Revert of Move (hopefully) remaining isolate related variables to toolchain.gypi (patchset #1 id:1 of https://codereview.chromium.org/2027213002/ )

Reason for revert:
Fails:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7182/steps/gclient%20runhooks/logs/stdio

Original issue's description:
> Move (hopefully) remaining isolate related variables to toolchain.gypi
>
> BUG=chromium:609107
> R=machenbach@chromium.org
>
> Committed: https://crrev.com/a68a1eb38dda0a1eba3b7644a172d2f85e9c7abe
> Cr-Commit-Position: refs/heads/master@{#36664}

TBR=jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:609107

Review-Url: https://codereview.chromium.org/2038463002
Cr-Commit-Position: refs/heads/master@{#36665}

BUG=chromium:609107
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2027213002
Cr-Commit-Position: refs/heads/master@{#36664}

Revert of Reland "[heap] Fine-grained JSArrayBuffer tracking" (patchset #7 id:180001 of https://codereview.chromium.org/2026633003/ )

Reason for revert:
Also failing with the new implementation:
  https://build.chromium.org/p/chromium.gpu/builders/Linux%20Debug%20%28NVIDIA%29/builds/62646

Will do a local repro now.

Original issue's description:
> Track based on JSArrayBuffer addresses on pages instead of the attached
> backing store.
>
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
>
> BUG=chromium:611688
> LOG=N
> TEST=cctest/test-array-buffer-tracker/*
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
>
> Committed: https://crrev.com/279e274eccf95fbb4bd41d908b9153acf6ec118a
> Cr-Commit-Position: refs/heads/master@{#36653}

TBR=hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688

Review-Url: https://codereview.chromium.org/2032973002
Cr-Commit-Position: refs/heads/master@{#36663}

Reland of https://codereview.chromium.org/2026173003 (reverted by
https://codereview.chromium.org/2029563002).

Additionally, we need to record environment markers even for the
case of a.length, where a is aliased arguments (which crankshaft
optimizes to constant for the inlined case or to HArgumentsLength
when not inlined).

BUG=chromium:612146

Review-Url: https://codereview.chromium.org/2028243002
Cr-Commit-Position: refs/heads/master@{#36662}

     result is sign-extended on 64bit for functions
     LCodeGen::DoFlooringDivI and LCodeGen::DoDivI

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2029273002
Cr-Commit-Position: refs/heads/master@{#36661}

Eliminating dead code in the bytecode array builder doesn't play nice
with the register elimination optimizer. We should move it to it's own
stage in the optimization pipeline, however doing so would require
refactoring of how we deal with jumps, so for now just remove the dead
code elimination optimization.

BUG=chromium:616064

Review-Url: https://codereview.chromium.org/2030583002
Cr-Commit-Position: refs/heads/master@{#36660}

Revert of Extend HasProperty stub with dictionary-mode and double-elements objects support. (patchset #8 id:280001 of https://codereview.chromium.org/1995453002/ )

Reason for revert:
There are crashes on Win32 and Win64 bots.

Original issue's description:
> Extend HasProperty stub with dictionary-mode, string wrapper and double-elements objects support.
>
> This CL also replaces some Branch() usages with GotoIf/GotoUnless.
>
> BUG=v8:2743
> LOG=Y
>
> Committed: https://crrev.com/24066b6df4259b302edfa1db884c479008776a7e
> Cr-Commit-Position: refs/heads/master@{#36657}

TBR=verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2743

Review-Url: https://codereview.chromium.org/2028333002
Cr-Commit-Position: refs/heads/master@{#36659}

Review-Url: https://codereview.chromium.org/2031593002
Cr-Commit-Position: refs/heads/master@{#36658}

This CL also replaces some Branch() usages with GotoIf/GotoUnless.

BUG=v8:2743
LOG=Y

Review-Url: https://codereview.chromium.org/1995453002
Cr-Commit-Position: refs/heads/master@{#36657}

We already implemented CPU time for OS X and POSIX, this path is a
follow up for the implementation on Windows.

BUG=v8:5000
LOG=n

Review-Url: https://codereview.chromium.org/1977983003
Cr-Commit-Position: refs/heads/master@{#36656}

https://codereview.chromium.org/2001393004 makes TypedArray
length property writable, which means we shouldn't depend on it.
Instead, use %_TypedArrayGetLength% to get length.

Attached regression test.

BUG=chromium:615776

Review-Url: https://codereview.chromium.org/2020203006
Cr-Commit-Position: refs/heads/master@{#36655}

Adds instructions for ARM to push floats.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2024443002
Cr-Commit-Position: refs/heads/master@{#36654}

backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Review-Url: https://codereview.chromium.org/2026633003
Cr-Commit-Position: refs/heads/master@{#36653}

This CL also updates the elements kind transition lookup logic:
1) First we go back to the root map,
2) Follow elements kind transitions,
3) Replay the property transitions.

BUG=v8:5009
LOG=Y
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2015513002
Cr-Commit-Position: refs/heads/master@{#36652}

BUG=chromium:414964
LOG=NO

Review-Url: https://codereview.chromium.org/1975593004
Cr-Commit-Position: refs/heads/master@{#36651}