port df2578d2 (r41368)

  original commit message:
  Improves performance in simple, single element case by 5% and in multiple
  elements cases by 2%.

BUG=

Review-Url: https://codereview.chromium.org/2540803004
Cr-Commit-Position: refs/heads/master@{#41377}

Blocking roll: https://codereview.chromium.org/2537173002/

NOTRY=true

Review-Url: https://codereview.chromium.org/2532103004
Cr-Commit-Position: refs/heads/master@{#41376}

This adds consistency checks for function kind and scope type to
SharedFunctionInfoVerify.

It also fixes an inconsistency in the creation of a ScopeInfo.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2537093002
Cr-Commit-Position: refs/heads/master@{#41375}

When removing a scope (see FinalizeBlockScope), remember the removal by making
the scope its own sibling.  This avoid recalculating the information later on.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2536993003
Cr-Commit-Position: refs/heads/master@{#41374}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/11a223f..4e4ff82

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/3950931..2dd86f1

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/4d70bef..f81598c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2539733003
Cr-Commit-Position: refs/heads/master@{#41373}

Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}

BUG=chromium:350797
R=dgozman@chromium.org
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527473004
Cr-Commit-Position: refs/heads/master@{#41371}

Port df2578d2

Original Commit Message:

    Improves performance in simple, single element case by 5% and in multiple
    elements cases by 2%.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2537513005
Cr-Commit-Position: refs/heads/master@{#41370}

Rename it to better represent the reason. Also makes the inspector sentence
"Not Optimized: Optimized too many times" look less confusing.

Review-Url: https://codereview.chromium.org/2530423003
Cr-Commit-Position: refs/heads/master@{#41369}

Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}

Functions with asm-wasm data shouldn't be marked for optimization, since
they will be optimized using the asm-wasm data instead.

Review-Url: https://codereview.chromium.org/2537103002
Cr-Commit-Position: refs/heads/master@{#41367}

Review-Url: https://codereview.chromium.org/2534123003
Cr-Commit-Position: refs/heads/master@{#41366}

This removes support for dynamic scoping via with-statement constructs
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=rmcilroy@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2533283002
Cr-Commit-Position: refs/heads/master@{#41365}

BUG=chromium:669017

Review-Url: https://codereview.chromium.org/2536783003
Cr-Commit-Position: refs/heads/master@{#41364}

This not only potentially improves performance, but also avoids weird
linker errors, like the one below, where I used Smi::kMinValue in a
DCHECK_LE.

> [421/649] LINK ./mksnapshot
> FAILED: mksnapshot
> src/base/logging.h|178| error: undefined reference to
  'v8::internal::Smi::kMinValue'

R=bmeurer@chromium.org, ishell@chromium.org

Committed: https://crrev.com/76723502528c5af003fdffc3520632ea2a13fef3
Review-Url: https://codereview.chromium.org/2524093002
Cr-Original-Commit-Position: refs/heads/master@{#41273}
Cr-Commit-Position: refs/heads/master@{#41363}

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2531983004
Cr-Commit-Position: refs/heads/master@{#41362}

Since the majority of bytecodes have a next instruction, and we iterate
over the bytecodes backwards, we can keep the previous seen (i.e.
sequentially next) bytecode's liveness on a variable instead of looking
it up again.

Review-Url: https://codereview.chromium.org/2541463002
Cr-Commit-Position: refs/heads/master@{#41361}

BUG=chromium:669494
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2533303002
Cr-Commit-Position: refs/heads/master@{#41360}

The EscapeStatusAnalysis didn't know anything about the simplified
operator ConvertTaggedHoleToUndefined, thus leading to a crash. We
now just handled it by pretending that any allocation that goes into
such a node escapes.

BUG=chromium:669451
R=tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2533263002
Cr-Commit-Position: refs/heads/master@{#41359}

This removes reservation of unused {BailoutId} numbers for all class
literals. These language constructs are by now solely funneled through
bytecode and specific ids for deoptimization are no longer needed.

R=rmcilroy@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2535223002
Cr-Commit-Position: refs/heads/master@{#41358}

This removes support for iterator loops (i.e. for-of loop constructs)
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2534883004
Cr-Commit-Position: refs/heads/master@{#41357}

Adds a bytecode_age field to BytecodeArray objects. This is incremented each
time the bytecode array is marked by GC, and reset to zero if the bytecode
is executed.

This is used to enable the CompilationCache for interpreted functions,
where Interpreted entries are evicted once the bytecode becomes old.

BUG=chromium:666275,v8:4680

Review-Url: https://codereview.chromium.org/2534763003
Cr-Commit-Position: refs/heads/master@{#41356}

Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}

MarkingParity was used to avoid performing an operation on an object if it was
marked multiple times. We no longer mark things multiple times, so this concept
is no longer required.

BUG=chromium:666275

Review-Url: https://codereview.chromium.org/2529173002
Cr-Commit-Position: refs/heads/master@{#41354}

BUG=v8:5664

Review-Url: https://codereview.chromium.org/2536153002
Cr-Commit-Position: refs/heads/master@{#41353}

For bound functions on the right-hand side of instanceof we can
constant-fold to the actual [[BoundTargetFunction]], actually
instance OrdinaryHasInstance. Move the Function.prototype[@@hasInstance]
reduction up to the JSCallReducer to allow this optimization to become
effective (and also enable other optimizations).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2537763002
Cr-Commit-Position: refs/heads/master@{#41352}

BUG=chromium:668748

Review-Url: https://codereview.chromium.org/2534123002
Cr-Commit-Position: refs/heads/master@{#41351}

This reverts commit 810fcb28.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2530383003
Cr-Commit-Position: refs/heads/master@{#41350}

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/39b1db2..991f459

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/25d57ea..811a2c3

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapul/+log/6962f5c..3950931

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/c1a2371..dda089a

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clan/+log/75350a8..4d70bef

Rolling v8/tools/swarming_client: https://chromium.googlesource.com/external/swarming.clien/+log/380e326..ebc8dab

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2538723002
Cr-Commit-Position: refs/heads/master@{#41349}

This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}

This also ports some build overrides including:
https://codereview.chromium.org/2512043002/

BUG=chromium:659726

Review-Url: https://codereview.chromium.org/2532043002
Cr-Commit-Position: refs/heads/master@{#41347}

Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset #17 id:320001 of https://codereview.chromium.org/2523893003/ )

Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}

This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}

Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}

FunctionTemplateInfo::SetPrototypeProviderTemplate adds support for sharing
prototypes between several function templates. This is used to properly set up
Image.prototype and HTMLImageElement.protoype which should be equal according
to the spec.

BUG=chromium:2969

Review-Url: https://codereview.chromium.org/2531653002
Cr-Commit-Position: refs/heads/master@{#41343}

Revert of [heap] Reland: Use store buffer for writes coming from mutator. (patchset #1 id:1 of https://codereview.chromium.org/2529293004/ )

Reason for revert:
Suspect for tsan failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12915

Original issue's description:
> [heap] Reland: Use store buffer for writes coming from mutator.
>
> This reverts commit 061c2ab2.
>
> BUG=chromium:648568, chromium:669270
>
> Committed: https://crrev.com/fa2fdf275197185d9bca9d5e72c16a60722c3893
> Cr-Commit-Position: refs/heads/master@{#41341}

TBR=mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2534803004
Cr-Commit-Position: refs/heads/master@{#41342}

This reverts commit 061c2ab2.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2529293004
Cr-Commit-Position: refs/heads/master@{#41341}

BUG=v8:5683
NOTRY=true
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2541433002
Cr-Commit-Position: refs/heads/master@{#41340}

The range-based exception handler table is by now only used for bytecode
arrays. The semantics of the interpreter are that bytecode offsets point
to the beginning of the currently executing bytecode instruction. Uses
hence need to compensate for lookups based on a "retrun address". This
change removes the need for such off-by-one compensations by changing
lookup semantics to be based on "current instruction" offsets.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2534893002
Cr-Commit-Position: refs/heads/master@{#41339}

Microbenchmarks show a 4x improvement on the fast path and 2.5x improvement on
the slow path when compared to the CPP builtin implementation.

Compared to the old JS implementation, the fast path is 20% faster and the slow
path 35% slower.

BUG=v8:5339,v8:5562

Review-Url: https://codereview.chromium.org/2527963002
Cr-Commit-Position: refs/heads/master@{#41338}