Change-Id: I809b10935c92a129bd633c98759ba9d800aaa91c
Reviewed-on: https://chromium-review.googlesource.com/934503Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51587}

Bug: v8:7310
Change-Id: I73f59cb4119e7f27828f09ac33fc247fc4983742
Reviewed-on: https://chromium-review.googlesource.com/937723Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51586}

Currently all instances share the exact same export wrappers (pointed
to by the corresponding compiled module). This bug, however, does not
cause a problem at runtime. This CL makes sure that all compiled modules
have their own export wrapper table during instance instantiation.

Change-Id: I385d79ab8ad42672f7ab72755387d161b1e9ee81
Reviewed-on: https://chromium-review.googlesource.com/937715
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51585}

Refactor the helpers to use return values instead of continuation functors.
This reduces compilation time in Release mode from 30s to 10s (Debug: 10->7s).
Also shorten the boilerplate code a bit.

Bug: v8:7310
Change-Id: Icf6309e4fd5478a1f55979112d1219bc7eaf4e6d
Reviewed-on: https://chromium-review.googlesource.com/938316
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51584}

R=jkummerow@chromium.org

Bug: v8:7497
Change-Id: I4b75fde49a352a6e8d99211efdbb09d77aa88069
Reviewed-on: https://chromium-review.googlesource.com/938183Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51583}

This proposal has not moved beyoned stage 2 in two years, and has never
moved past the HARMONY_INPROGRESS state in flag-definitions.h.

It was originally added to aide in desugaring yield*, but is no longer
used for that purpose.

Bug: v8:4700, v8:7310
Change-Id: Ieca40d8e4bf565516bbe71e47b996daa70d2e835
Reviewed-on: https://chromium-review.googlesource.com/935297
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51582}

The x87 port itself has been gone for awhile.

Bug: v8:7310
Change-Id: I1c938ba93720af361733f2c09dc5f128173b5675
Reviewed-on: https://chromium-review.googlesource.com/935198Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51581}

Port 3db1d4a5

Original Commit Message:

    Currently, atomic operations assume the default to be 32-bit
    operations, fix opcode names for differentiation between 32/64-bit
    operations.

R=gdeepti@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I79c195ce7474f329ccb2446fad1f81bab41e7329
Reviewed-on: https://chromium-review.googlesource.com/937921Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51580}

Recent Fuchsia SDKs have begun removing both symbols for unsupported
POSIX APIs, and also the relevant definitions, and even headers.

This CL:
- Removes dependencies on <sys/resource.h>.
- Adds a working implementation of GetUserTime().
- Fixes GetCurrentThreadId() to use the native (32-bit) Fuchsia thread
  handle, rather than the (64-bit) pthread*, to avoid potential for id
  clashes when truncating the value into a 32-bit int.

Bug: chromium:707030
Change-Id: Ic5774e138f7657123dd65d0fb7ef5d87876766e8
Reviewed-on: https://chromium-review.googlesource.com/933247Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51579}

This reverts commit 800daded.

Reason for revert: breaks arm64 build

Original change's description:
> [turbofan] Masking/poisoning in codegen (optimized code, arm64)
> 
> This introduces masking of loads with speculation bit during code generation.
> At the moment, this is done only under the
> --branch-load-poisoning flag, and this CL enlarges the set of supported
> platforms from {x64, arm} to {x64, arm, arm64}.
> 
> Overview of changes:
> - new register configuration configuration with one register reserved for
>   the speculation poison/mask (kSpeculationPoisonRegister).
> - in codegen, we introduce an update to the poison register at the starts
>   of all successors of branches (and deopts) that are marked as safety
>   branches (deopts).
> - in memory optimizer, we lower all field and element loads to PoisonedLoads.
> - poisoned loads are then masked in codegen with the poison register.
>   * only integer loads are masked at the moment.
> 
> Bug: chromium:798964
> Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4
> Reviewed-on: https://chromium-review.googlesource.com/928724
> Commit-Queue: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51576}

TBR=rmcilroy@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,rodolph.perfetta@arm.com,martyn.capewell@arm.com,pierre.langlois@arm.com

Change-Id: I1b5dad27f9620c7da3277602081f392de6221caf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:798964
Reviewed-on: https://chromium-review.googlesource.com/937861Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51578}

This reverts commit c41c7a09.

Reason for revert: relanding now that the perf waterfall has had a stab at this revert.

Original change's description:
> Revert "Use all available workers for concurrent marking."
> 
> This reverts commit 3c62f7ae.
> (and commit 4939463c)
> 
> The goal of this revert is to contrast the effect on perf bots of
> landing it vs reverting it to more easily attribute its impact.
> 
> R=​hpayer@chromium.org
> 
> Bug: chromium:812178
> Change-Id: I7c977b1b0b587f787263272400d87f6aae7af634
> Reviewed-on: https://chromium-review.googlesource.com/936761
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51546}

TBR=gab@chromium.org,hpayer@chromium.org

Change-Id: I1ecfc70867dc5424cba1a9ecd229ae031c3e9aa4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:812178
Reviewed-on: https://chromium-review.googlesource.com/937725Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51577}

This introduces masking of loads with speculation bit during code generation.
At the moment, this is done only under the
--branch-load-poisoning flag, and this CL enlarges the set of supported
platforms from {x64, arm} to {x64, arm, arm64}.

Overview of changes:
- new register configuration configuration with one register reserved for
  the speculation poison/mask (kSpeculationPoisonRegister).
- in codegen, we introduce an update to the poison register at the starts
  of all successors of branches (and deopts) that are marked as safety
  branches (deopts).
- in memory optimizer, we lower all field and element loads to PoisonedLoads.
- poisoned loads are then masked in codegen with the poison register.
  * only integer loads are masked at the moment.

Bug: chromium:798964
Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4
Reviewed-on: https://chromium-review.googlesource.com/928724
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51576}

Implement Load and Store instructions for liftoff on MIPS.
Function CallTrapCallbackForTesting also implemented  to prevent
test from failing when address is out of range.

Bug: v8:6600
Change-Id: I85e48334d171ad6d86a02eeba51e4f07edaf9648
Reviewed-on: https://chromium-review.googlesource.com/934133
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51575}

Previously, Strings without an iterator would go to the runtime path
and fail on because it expected a JSReceiver type. This was in-line
with what the elements accessor expected. We can actually handle all
object types in the final slow path (using LookupIterator) so it is no
problem to change the accept types.

Bug: chromium:816289
Change-Id: Iebb8de0bb7551aee3894c8a23836d079c93726a7
Reviewed-on: https://chromium-review.googlesource.com/937461Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51574}

This is a reland of e7f9fb4a.

Original change's description:
> [Assembler][x64] Make Operand immutable
> 
> This CL removes all setters from the Operand and removes the friendship
> relation between Assembler and Operand. All data fields of the Operand
> are set exactly once in the constructor, the Operand is immutable
> afterwards.
> In order to construct the data of an Operand easily, the OperandBuilder
> is introduced. After building an Operand, the data is copied to the
> const field of the Operand.
> 
> R=mstarzinger@chromium.org
> 
> Bug: v8:7310
> Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b
> Reviewed-on: https://chromium-review.googlesource.com/936741
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51563}

Bug: v8:7310
Change-Id: I84df5e11b1811585fbba7309e3bb9c6b17e18c0b
Reviewed-on: https://chromium-review.googlesource.com/936628Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51573}

These helpers support off-heap code objects, for which they return
start, end, and size of the off-heap instruction stream.

Bug: v8:6666
Change-Id: Ib5e819d976eee3073b0354b8d8ce324b691f1b15
Reviewed-on: https://chromium-review.googlesource.com/937281
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51572}

This is a reland of 087e9daa.

Original change's description:
> [builtins] Update off-heap-safe list
>
> TBR=yangguo@chromium.org
>
> Bug: v8:6666
> Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6
> Reviewed-on: https://chromium-review.googlesource.com/937302
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51567}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I9475c8e412f765623131f168e9fe25d8082d061e
Reviewed-on: https://chromium-review.googlesource.com/937541Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51571}

R=jgruber@chromium.org

Change-Id: I8328fdaf5d53850b87dd16867255d4325ab9cd9c
Reviewed-on: https://chromium-review.googlesource.com/936644Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51570}

This reverts commit 087e9daa.

Reason for revert: https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/15549

Original change's description:
> [builtins] Update off-heap-safe list
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6666
> Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6
> Reviewed-on: https://chromium-review.googlesource.com/937302
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51567}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: If37f28e0bfbd1fe495ec425d8306aa081e75eca4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/937303Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51569}

Refactor EmitUnOp to be templatized in the type and the emit function,
similar to EmitBinOp. This simplified adding f32 and f64 unops.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Iaab473a3bbcc45673ff6190d6b56244c48bfa5a6
Reviewed-on: https://chromium-review.googlesource.com/937201
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51568}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6
Reviewed-on: https://chromium-review.googlesource.com/937302Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51567}

I loosened the DCHECKs here but I think they are still fundamentally
safe: `length` must be <= the actual length of the source (so that
there are actually enough elements to copy), and `length` must also be
<= the destination length, minus the offset (so there is enough space
to copy the elements into).

Bug: chromium:816317
Change-Id: Ice00ac60f4884363f6065ffee71f6ab1d1b32dbc
Reviewed-on: https://chromium-review.googlesource.com/937209Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51566}

BUG=v8:5402,v8:7310

Change-Id: Ic3ee7d2dec0403e7831f51735365c26caadc6a7b
Reviewed-on: https://chromium-review.googlesource.com/934136
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51565}

This reverts commit e7f9fb4a.

Reason for revert: msvc compile error: https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/1573

Original change's description:
> [Assembler][x64] Make Operand immutable
> 
> This CL removes all setters from the Operand and removes the friendship
> relation between Assembler and Operand. All data fields of the Operand
> are set exactly once in the constructor, the Operand is immutable
> afterwards.
> In order to construct the data of an Operand easily, the OperandBuilder
> is introduced. After building an Operand, the data is copied to the
> const field of the Operand.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: v8:7310
> Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b
> Reviewed-on: https://chromium-review.googlesource.com/936741
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51563}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I8ae40de35e81765549f93ffe58f1b12286de6333
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7310
Reviewed-on: https://chromium-review.googlesource.com/936627Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51564}

This CL removes all setters from the Operand and removes the friendship
relation between Assembler and Operand. All data fields of the Operand
are set exactly once in the constructor, the Operand is immutable
afterwards.
In order to construct the data of an Operand easily, the OperandBuilder
is introduced. After building an Operand, the data is copied to the
const field of the Operand.

R=mstarzinger@chromium.org

Bug: v8:7310
Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b
Reviewed-on: https://chromium-review.googlesource.com/936741Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51563}

With this, `Builtins::IsBuiltinId(code->builtin_index())` turns into
`Builtins::IsBuiltin(code)`.

Bug: v8:6666
Change-Id: Id731299cf5eb3f213933d3a9b3ae78d9bb95e757
Reviewed-on: https://chromium-review.googlesource.com/937205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51562}

There's two considerations involving off-heap code and safepoint
tables.

1. Since the safepoint table is embedded within the instructions area
of code objects, we need to ensure that the actual instruction size
(i.e.  safepoint_table_offset if a code object has safepoints) is
large enough for the off-heap trampoline.

2. The pc-relative calculation in SafepointTable::FindEntry must be
able to handle off-heap pcs.

Bug: v8:6666
Change-Id: I92a5ecc49d0a78755b89c3c5774523afb21cd724
Reviewed-on: https://chromium-review.googlesource.com/934242Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51561}

Change-Id: I9185b17c73ad4486b81538a8ce2f84271b820919
Reviewed-on: https://chromium-review.googlesource.com/936763Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51560}

The key -> value edge is shown as "<index> / WeakMap", where <index> is
the index of the edge in the key.

Bug: chromium:778739, chromium:749502
Change-Id: I657051695f2a171372788dbb777543a55a35d554
Reviewed-on: https://chromium-review.googlesource.com/926524
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51559}

R=jgruber@chromium.org

Bug: v8:5530
Change-Id: I1680beaa665b6937df2e26d20cb69cc8577a21a9
Reviewed-on: https://chromium-review.googlesource.com/937203Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51558}

TBR=jgruber@chromium.org
NOTREECHECKS=true
NOTRY=true

Change-Id: Id5d81f863fa6d14ac86d49b6516e577c2da7a999
Reviewed-on: https://chromium-review.googlesource.com/936543Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51557}

This CL changes the builtin
  StringSubstring(string, start, end)
to take start and end as untagged IntPtr values.

Bug: v8:7250, v8:7340

Change-Id: I39700d087da903f076a6ca163a8f880d31eea3a0
Reviewed-on: https://chromium-review.googlesource.com/923961
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51556}

The Operand class is small enough to be efficiently passed by value.
This saves binary size and performance because the Operand does not need
to be emitted to the caller's frame and loaded in the callee.
Binary saving is 37kB in release mode on ia32.

R=mstarzinger@chromium.org

Bug: v8:7310
Change-Id: Ibc103622ec216725c762c2ba4bb96451c99db556
Reviewed-on: https://chromium-review.googlesource.com/934264
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51555}

Snapshots don't yet work in 64-bit win/cross builds, so disable them
until they do.

No behavior change in builds that aren't 64-bit win/cross builds.

Bug: chromium:803591
Change-Id: I7a04c7e01a58a95a2bfb78c7d2593c7c5c5041cf
Reviewed-on: https://chromium-review.googlesource.com/936668Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51554}

This adds support for poisoning the stack pointer and implicit register
arguments like the context register and the function register in the
prologue of generated code with JavaScript linkage. The speculation
poison is computed similarly to the interpreter by matching expected
with actual code start addresses.

R=jarin@chromium.org,rmcilroy@chromium.org
BUG=chromium:798964

Change-Id: I5fa48844745459cf7b3d00c407a7b835f61c857b
Reviewed-on: https://chromium-review.googlesource.com/919167
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51553}

R=herhut@chromium.org, jgruber@chromium.org

Bug: v8:7310, v8:5510
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Icefd10b6cc210e5bb2684d18b091179ead387326
Reviewed-on: https://chromium-review.googlesource.com/934445
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51552}

Currently we didn't always consistently use the String feedback on
JSAdd, but only if JSTypedLowering would already figure out statically
that one of the inputs is already a String. That leads to some odd
performance cliffs, as highlighted in the referenced bug.

This CL fixes the JSTypedLowering::ReduceJSAdd to always bake in the
String feedback. This improves the relevant performance tests from the
bug from

  console.timeEnd: Runtime join3, 967.512000
  console.timeEnd: Runtime join, 1004.599000
  console.timeEnd: Runtime join3, 1124.764000
  console.timeEnd: Runtime join, 966.164000
  console.timeEnd: Runtime join3, 1145.296000
  console.timeEnd: Runtime join, 966.176000
  console.timeEnd: Runtime join3, 1145.272000
  console.timeEnd: Runtime join, 931.266000

to

  console.timeEnd: Runtime join3, 903.050000
  console.timeEnd: Runtime join, 856.509000
  console.timeEnd: Runtime join3, 945.144000
  console.timeEnd: Runtime join, 840.038000
  console.timeEnd: Runtime join3, 927.965000
  console.timeEnd: Runtime join, 841.263000
  console.timeEnd: Runtime join3, 929.342000
  console.timeEnd: Runtime join, 858.143000

which corresponds to an 8-18% improvement.

Bug: v8:7415
Change-Id: I62e008298e4ee0864885b37817c91d055acf2a09
Reviewed-on: https://chromium-review.googlesource.com/936643Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51551}

Removing includes which are not needed and also not indirectly pulled in.

BUG=v8:7490, v8:7310

Change-Id: I219ba92c3281c3c245cc6c5574c85c2d51a217a9
Reviewed-on: https://chromium-review.googlesource.com/934722Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51550}

Bug: v8:7310
Change-Id: Ib9c40bababbb688305be7bea262a4348805a1f18
Reviewed-on: https://chromium-review.googlesource.com/936762Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51549}

The CreateClosureMode introduced with 2ece046c is still not 100%
fail-safe and doesn't scale. What we really need instead, especially
when we might start removing the SharedFunctionInfo::code field
eventually, is to tell the JSCreateClosure node which code object to
use. So instead of adding magic around it, let's just pass it to the
node.

Bug: v8:2206, v8:7253, v8:7310
Change-Id: Iedb6ae468a763643617975f47d96854d1aeafbe9
Reviewed-on: https://chromium-review.googlesource.com/937121Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51548}