R=verwaest@chromium.org

Committed: https://crrev.com/93eb633214e0f97bf70ae30d2a07b7fbbaa78266
Cr-Commit-Position: refs/heads/master@{#32285}

Review URL: https://codereview.chromium.org/1463803002

Cr-Commit-Position: refs/heads/master@{#32339}

The fast-prototype test has been outsmarted by constructor inlining
because the instantiation is been correctly optimized away. Internal
state introspection about prototype turning fast was upset by that.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1474763007

Cr-Commit-Position: refs/heads/master@{#32338}

This adapts the constructor call inlining machinery to only allocate
implicit receivers and perform the return value check if the callee
needs it.

R=verwaest@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1476833002

Cr-Commit-Position: refs/heads/master@{#32337}

Up until now we sometimes pass Smi 0 around as closure and expect the
runtime to translate that appropriately. But we need to be careful in
some places to not confuse the Smi 0 with a real closure. However, we
could instead just pass the correct closure extracted from the native
context.

This addresses three long-standing TODOs in the JSTypedLowering pass.

Drive-by-fix: Further unify error message reporting for ToObject (we had
a special message in case of ToObject error in with context creation).

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1475383002

Cr-Commit-Position: refs/heads/master@{#32336}

BUG=chromium:535160, chromium:561530
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1476133002

Cr-Commit-Position: refs/heads/master@{#32335}

No more deprecation warnings up to line 11k.

BUG=

Review URL: https://codereview.chromium.org/1427643005

Cr-Commit-Position: refs/heads/master@{#32334}

Removing bytecode graph builder tests as they are high maintenance and
have limited use, ie they track changes in the implementation rather
than behaviour.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1477783003

Cr-Commit-Position: refs/heads/master@{#32333}

This removes an optimization in the static JSFunction visitor that
eagerly marked through to the SharedFunctionInfo for code flushing
candidates. This causes all processing in VisitJSFunction to be
side-stepped and hence might cause leaks.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1476223002

Cr-Commit-Position: refs/heads/master@{#32332}

This way, we can also capture a stack trace for SMIs

BUG=chromium:495801
R=yangguo@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1472143006

Cr-Commit-Position: refs/heads/master@{#32331}

For a * b with only truncated word32 uses (or result known to be in
signed32 range), we can use Int32Mul if we know for sure that the
intermediate result is inside the safe integer range, and a and b are
in signed32 range.

Drive-by-fix: Also use TypeCache in SimplifiedLowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1478953002

Cr-Commit-Position: refs/heads/master@{#32330}

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1477163002

Cr-Commit-Position: refs/heads/master@{#32329}

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1478613004

Cr-Commit-Position: refs/heads/master@{#32328}

BUG=chromium:561975
LOG=n

Review URL: https://codereview.chromium.org/1480853002

Cr-Commit-Position: refs/heads/master@{#32327}

Port https://codereview.chromium.org/1474923002

BUG=chromium:538614,chromium:559530,chromium:560589
LOG=n
TBR=jochen@chromium.org, thakis@chromium.org, hans@chromium.org,

Review URL: https://codereview.chromium.org/1478863005

Cr-Commit-Position: refs/heads/master@{#32326}

The TruncateFloat32ToInt64 operator converts a float32 to an int64 using
the round-to-zero rounding mode (truncate). If the input value is
outside the int64 range, then the result depends on the architecture. I
implemented the operator on x64, arm64, and mips64.

R=titzer@chromium.org, jacob.bramley@arm.com

Committed: https://crrev.com/1df1066c3c77464d2a68d7c8d501a5a0f3ad195a
Cr-Commit-Position: refs/heads/master@{#32315}

Review URL: https://codereview.chromium.org/1476063002

Cr-Commit-Position: refs/heads/master@{#32325}

BUG=v8:3101, v8:3330
LOG=N

Review URL: https://codereview.chromium.org/1473323003

Cr-Commit-Position: refs/heads/master@{#32324}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1464313009

Cr-Commit-Position: refs/heads/master@{#32323}

Just use the same workaround as on win32.

Also replace fmod calls with modulo() for consistency

BUG=none
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1479773002

Cr-Commit-Position: refs/heads/master@{#32322}

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1479483004

Cr-Commit-Position: refs/heads/master@{#32321}

LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1479543002

Cr-Commit-Position: refs/heads/master@{#32320}

Newer perf.data contains both MMAP and MMAP2 record type,
but MMAP2 record type is not supported in previous ll_prof,
MMAP2 record information will be lost.

BUG=v8:4569
LOG=n

Review URL: https://codereview.chromium.org/1469153004

Cr-Commit-Position: refs/heads/master@{#32319}

R=yangguo@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1478683003

Cr-Commit-Position: refs/heads/master@{#32318}

This CL also removes JSTypedArray and JSDataView static visitor Ids because the visiting logic is the same as for ordinary JSObject.

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1476753003

Cr-Commit-Position: refs/heads/master@{#32317}

Revert of [turbofan] Implemented the TruncateFloat32ToInt64 TurboFan operator. (patchset #1 id:1 of https://codereview.chromium.org/1476063002/ )

Reason for revert:
Unexpected error occurred.

Original issue's description:
> [turbofan] Implemented the TruncateFloat32ToInt64 TurboFan operator.
>
> The TruncateFloat32ToInt64 operator converts a float32 to an int64 using
> the round-to-zero rounding mode (truncate). If the input value is
> outside the int64 range, then the result depends on the architecture. I
> implemented the operator on x64, arm64, and mips64.
>
> R=titzer@chromium.org, jacob.bramley@arm.com
>
> Committed: https://crrev.com/1df1066c3c77464d2a68d7c8d501a5a0f3ad195a
> Cr-Commit-Position: refs/heads/master@{#32315}

TBR=jacob.bramley@arm.com,titzer@chromium.org,v8-mips-ports@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1475343002

Cr-Commit-Position: refs/heads/master@{#32316}

The TruncateFloat32ToInt64 operator converts a float32 to an int64 using
the round-to-zero rounding mode (truncate). If the input value is
outside the int64 range, then the result depends on the architecture. I
implemented the operator on x64, arm64, and mips64.

R=titzer@chromium.org, jacob.bramley@arm.com

Review URL: https://codereview.chromium.org/1476063002

Cr-Commit-Position: refs/heads/master@{#32315}

Contributed by Fedor Indutny <fedor@indutny.com>.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1478933002

Cr-Commit-Position: refs/heads/master@{#32314}

Revert of binary-operator-reducer: reduce mul+div(shift) (patchset #11 id:200001 of https://codereview.chromium.org/1350223006/ )

Reason for revert:
This is also unsound for the reasons outlined in
https://codereview.chromium.org/1473073004/
Will help Fedor to implement a solution based on simplified operators.

Original issue's description:
> binary-operator-reducer: reduce mul+div(shift)
>
> Reduction Input:
>
>     ChangeInt32ToFloat64=>          TruncateFloat64ToInt32
>                          Float64Mul=>
>     ChangeInt32ToFloat64=>          Float64Div=>TruncateFloat64ToInt32
>
> Output:
>
>          =>  TruncateInt64ToInt32
> Int64Mul
>          =>  Int64Shr => TruncateInt64ToInt32
>
> Test code:
>
>     function mul(a, b) {
>       var l = a & 0x3ffffff;
>       var h = b & 0x3ffffff;
>       var m = l * h;
>
>       var rl = m & 0x3ffffff;
>       var rh = (m / 0x4000000) | 0;
>
>       return rl | rh;
>     }
>
>     mul(1, 2);
>     var a0 = mul(0x3ffffff, 0x3ffffff);
>     mul(0x0, 0x0);
>     %OptimizeFunctionOnNextCall(mul);
>     var a1 = mul(0x3ffffff, 0x3ffffff);
>
>     print(a0 + ' == ' + a1);
>
> BUG=
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/461e5b49d022335a7fc4e9d172397a4bd48b93d4
> Cr-Commit-Position: refs/heads/master@{#31899}

TBR=mstarzinger@chromium.org,danno@chromium.org,titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1478923002

Cr-Commit-Position: refs/heads/master@{#32313}

Revert of [machine-operator-reducer] fix float truncation (patchset #8 id:140001 of https://codereview.chromium.org/1433353006/ )

Reason for revert:
This is also unsound for the reasons outlined in
https://codereview.chromium.org/1473073004/
Will reland the mjsunit test separately and help Fedor to implement a solution based on simplified operators.

Original issue's description:
> [machine-operator-reducer] fix float truncation
>
> Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
> `value`. Generally, `value` may have a range bigger than the one that
> could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
> instead, and only if the `value` fits into Float64 without precision
> loss.
>
> Add missing mjsunit test for 52bit multiplication/division optimization
> that has landed in refs/heads/master@{#31899}.
>
> BUG=
> R=titzer@google.com
>
> Committed: https://crrev.com/64efa2a904773816968992628f0bf0f1b7ae82be
> Cr-Commit-Position: refs/heads/master@{#32227}

TBR=titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1468313009

Cr-Commit-Position: refs/heads/master@{#32312}

Rolling v8/tools/clang to 18e54a1f3caadfa9fd3b3e3f561cc57b2d834ff7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1472413005

Cr-Commit-Position: refs/heads/master@{#32311}

Revert of [compiler] merge binary-operator-reducer (patchset #2 id:20001 of https://codereview.chromium.org/1473073004/ )

Reason for revert:
Unsound use of types in the MachineOperatorReducer. Will work on a sound solution with Fedor.

Original issue's description:
> [compiler] merge binary-operator-reducer
>
> Merge BinaryOperatorReducer into the MachineOperatorReducer class.
> It does not need `Revisit()` calls, because the newly inserted nodes are
> visited anyway, and there are no other methods that need AdvancedReducer
> there.
>
> BUG=
> R=titzer@chromium.org
>
> Committed: https://crrev.com/993ba9d2529a6401b3040b9263f8d06db7dbb4f1
> Cr-Commit-Position: refs/heads/master@{#32298}

TBR=titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1476763006

Cr-Commit-Position: refs/heads/master@{#32310}

  port 3d004eea (r32264)

  original commit message:
  This passes the new.target value in a register instead of through a
  side-channel via the construct stub. The interpreter entry trampoline
  stores this value in a bytecode register so that it can be accessed
  directly by the interpreter. The size of the interpreter stack frame
  hence grows by one slot.

BUG=

Review URL: https://codereview.chromium.org/1475043003

Cr-Commit-Position: refs/heads/master@{#32309}

The Float32RoundTiesEven operator rounds float32 numbers towards the nearest
integer. If the distance to two integers is the same, then the result is
the even integer. This is the default rounding mode of the ieee 754 floating
point standard.

I implemented the optional Float32RoundTiesEven operator on x64, ia32, arm, and arm64.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1477753002

Cr-Commit-Position: refs/heads/master@{#32308}

This will make sure that message tests cover both the parser and preparser
paths, just as we do for parsing-related cctests.

BUG=v8:4372
LOG=n

Review URL: https://codereview.chromium.org/1469383004

Cr-Commit-Position: refs/heads/master@{#32307}

Also fix CheckConflictingVarDeclarations() to properly handle
legacy const bindings. Without that change enabling the flag
causes code like:

  function f() { const x; var x; }

to throw an early error, rather than wait to throw the error
until f is invoked.

The previous patch ran into problems with the fuzzer; that crash was fixed
(with test coverage added) in https://crrev.com/ceb92ebfdfb561d71038793c02b42aa973f55ec4

BUG=v8:811
LOG=y
TBR=rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1473243006

Cr-Commit-Position: refs/heads/master@{#32306}

No more uses left for this code (thank goodness.)

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1474693003

Cr-Commit-Position: refs/heads/master@{#32305}

This should fix the Turbofan Octane/Mandreel regression introduced by

commit 9ea551aa
Author: jarin <jarin@chromium.org>
Date:   Sun Nov 22 05:45:38 2015 -0800

    [turbofan] Simplify lowering of number addition.

    Review URL: https://codereview.chromium.org/1471533002

    Cr-Commit-Position: refs/heads/master@{#32159}

Review URL: https://codereview.chromium.org/1477803002

Cr-Commit-Position: refs/heads/master@{#32304}

In this new version of test262, a number of known failing tests have
been changed to match the ES2016 semantics, which V8 implements.

R=adamk

Review URL: https://codereview.chromium.org/1475793004

Cr-Commit-Position: refs/heads/master@{#32303}

validating that the hot path does not spill - somewhat simpler code.

Cleared the scenario where a range is defined in a deferred block. The
code before was slightly more complicated by not leveraging the
property that these sort of ranges would be completely contained within
deferred blocks.

Moved "spills in deferred blocks" marking to a more appropriate
location.

One thing this CL achieves is correct support for scenarios where a
range is spilled both on the deferred and then hot path, and the ranges
concatenate. I owe better unit testing, which I will add in a subsequent
CL.

BUG=

Review URL: https://codereview.chromium.org/1472803004

Cr-Commit-Position: refs/heads/master@{#32302}

The Float32RoundTruncate operator rounds float32 numbers towards zero.
The operator is currently implemented on x64, ia32, arm, and arm64.

Additionally I added support for the float32 vrintz, vrintn, and vrinta
instructions to the arm simulator.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1468303005

Cr-Commit-Position: refs/heads/master@{#32301}

Always go through Assembler::FlushICache so we automatically use the
simulator when running with a simulator.

BUG=v8:2487
R=epertoso@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1480623002

Cr-Commit-Position: refs/heads/master@{#32300}