Split lowering of Select nodes into a separate graph reducer and be more
clever when lowering to diamonds, i.e. reuse diamonds that have the same
condition and only add more phis to it.

TEST=unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/702463002

Cr-Commit-Position: refs/heads/master@{#25078}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org, svenpanne@chromium.org
BUG=chromium:429194
LOG=n

Review URL: https://codereview.chromium.org/701533002

Cr-Commit-Position: refs/heads/master@{#25077}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/701513002

Cr-Commit-Position: refs/heads/master@{#25076}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/688413003

Cr-Commit-Position: refs/heads/master@{#25074}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/688323005

Cr-Commit-Position: refs/heads/master@{#25073}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/684523003

Cr-Commit-Position: refs/heads/master@{#25072}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/683133005

Cr-Commit-Position: refs/heads/master@{#25071}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/685623004

Cr-Commit-Position: refs/heads/master@{#25070}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r25067 for breaking Win64.

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/697093002

Cr-Commit-Position: refs/heads/master@{#25069}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/699603002

Cr-Commit-Position: refs/heads/master@{#25067}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25067 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/697073002

Cr-Commit-Position: refs/heads/master@{#25066}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Mark negative dividend case as deferred, as modulus by power of two with
negative dividend almost never appears in practice.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/699573002

Cr-Commit-Position: refs/heads/master@{#25065}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/701473002

Cr-Commit-Position: refs/heads/master@{#25064}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/697653002

Cr-Commit-Position: refs/heads/master@{#25063}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Now with more checkings! Skip the CallFunctionStub when the callee function can be statically determined.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/696223002

Cr-Commit-Position: refs/heads/master@{#25062}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25062 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=cctest,mjsunit,unittests
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/697663003

Cr-Commit-Position: refs/heads/master@{#25061}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org, rtoy@chromium.org
BUG=chromium:427468
LOG=Y

Review URL: https://codereview.chromium.org/695263002

Cr-Commit-Position: refs/heads/master@{#25060}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/700493002

Cr-Commit-Position: refs/heads/master@{#25058}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix for bug 429168, PdfJs regression. We pay a very high cost for AllocationResult being a > kPointerSize struct. This can be avoided by using Smis to indicate failure with retry spaces.

BUG=429168
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/699473002

Cr-Commit-Position: refs/heads/master@{#25057}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/701463002

Cr-Commit-Position: refs/heads/master@{#25056}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/697433003

Cr-Commit-Position: refs/heads/master@{#25055}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-register-allocator2

Review URL: https://codereview.chromium.org/697053002

Cr-Commit-Position: refs/heads/master@{#25054}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change uses an explicit queue for type-widening instead of the
generic algorithm. The trouble with the generic algorithm was that it
called the visitor on the same phi many times in a row (and thus caused
unnecessary retyping). I also think that the queue-based fixpoint is
more readable.

The CL cuts running time of the nbody-java benchmark from ~19s to ~15s,
the time spent in the typer goes from 4.5s to 1s. This is still a lot
- the root cause appears to be slow handling of union subtyping
(m*n for unions of sizes m and n). I see a re-typing of a
single phi node taking > 100ms. I will work on a fix with Andreas,
hopefully we can come up with some canonical representation
of unions at least for the common cases (union of Smi constants).

I have also changed the initial typer run to always compute a type, even
if we already had a type for the node. This fixes one assert failure
where context specialization updates a node without updating the type,
which confuses the typer when widening (as some types suddenly narrow).

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/689403002

Cr-Commit-Position: refs/heads/master@{#25053}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/662813002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

Cr-Commit-Position: refs/heads/master@{#25052}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Push tags to the repo not to the remote - which is a cache
checkout on the bots.

Add new files when doing pure svn commits. Otherwise, new
files are silently ignored and not committed.

BUG=408523
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/699493004

Cr-Commit-Position: refs/heads/master@{#25049}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25049 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=410721
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/693333002

Cr-Commit-Position: refs/heads/master@{#25046}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=bmeurer@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/683873002

Cr-Commit-Position: refs/heads/master@{#25045}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit 9845dfad (r25042) for failing tests.

TBR=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/693103004

Cr-Commit-Position: refs/heads/master@{#25044}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Removed workaround for this issue.

TEST=mjsunit, cctest on sim64
BUG=
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/695933002

Cr-Commit-Position: refs/heads/master@{#25043}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/694773002

Cr-Commit-Position: refs/heads/master@{#25042}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/696643002

Cr-Commit-Position: refs/heads/master@{#25041}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25041 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Instead of using multiple generations for the code, first only store the hash that gets aged. Once a hash matched on a next probe, actually cache the code. Use regular code aging to remove entries from the cache.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/675013004

Cr-Commit-Position: refs/heads/master@{#25040}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change has been inspired by Slava Chigrin <vchigrin@yandex-team.ru> (https://codereview.chromium.org/689663002/)

R=mvstanton@chromium.org, vchigrin@yandex-team.ru

Review URL: https://codereview.chromium.org/686103004

Cr-Commit-Position: refs/heads/master@{#25039}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159
LOG=N

Review URL: https://codereview.chromium.org/697473006

Cr-Commit-Position: refs/heads/master@{#25037}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=machenbach@chromium.org
BUG=

Review URL: https://codereview.chromium.org/695763003

Cr-Commit-Position: refs/heads/master@{#25036}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/698513003

Cr-Commit-Position: refs/heads/master@{#25035}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=410721
LOG=n
TEST=script_test.py
TBR=tandrii@chromium.org

Review URL: https://codereview.chromium.org/698513002

Cr-Commit-Position: refs/heads/master@{#25033}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Not clearing can lead to a crash under following conditions:
1. Backing store of a weak map is allocated in large object space.
2. The backing store is marked incrementaly via the weak map.
3. The weak map is updated and gets a new backing store.
4. The store buffer overflows and marks the chunk of the old backing store as
"scan on scavenge."
5. Mark-compact collection kills some elements of the weak map. Note that the
old backing store survives because it was marked incrementally, but its dead
elements are not cleared.
6. Scavenger iterates over the old backing store, tries to move a dead object
and crashes.

BUG=v8:3631
LOG=N
TEST=cctest/test-heap/Regress3631
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/686783003

Cr-Commit-Position: refs/heads/master@{#25032}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This simplifies escape handling and makes it easier to extend escapes for ES6.

PushBack just before detecting ILLEGAL is unnecessary, since we will abort the
scanning / parsing anyway at that point, and it doesn't matter where the cursor
exactly is. The error messages w/ PushBack are not any better or more correct
than without.

In addition: remove a comment about handling invalid escapes gracefully when we
no longer do. (*)

This CL includes a behavioral change: For input "var r = /foobar/g\urrrr;" we
used to report "unexpected_token: ILLEGAL" for "\u", but now we report
malformed_regexp_flags which is a more correct error message. (Note that the
code for reporting invalid_regexp_flags was dead, and invalid_regexp_flags is
not the right error message.)

Note that the V8 is more relaxed about unicode escapes in regexp flags than ES6
(see
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-regular-expressions )
and this CL doesn't change it. (V8 accepts any \uxxxx, ES6 spec says only a
certain value range is acceptable.)

(*) Code archaeology:

Originally, doing PushBack in ScanHexEscape made sense (see e.g., here
https://codereview.chromium.org/5063003/diff/6001/src/prescanner.h ), since we
wouldn't return ILLEGAL but treat an invalid escape sequence "\uxxxx" as
"uxxxx".

(The repo at that point contains another instance of the same function, from the
initial commit. The logic is the same.)

This behavior was changed in a "renaming" commit
https://codereview.chromium.org/7739020.

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/684873002

Cr-Commit-Position: refs/heads/master@{#25031}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

additionally rename data-flow.* to bit-vector.* as at some point these file became very inaccurately named

BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/683243005

Cr-Commit-Position: refs/heads/master@{#25030}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00